neoris/openvidu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

backend: Refactor login rate limiting to allow bypass in test environment

Browse Source
This commit is contained in:
Carlos Santos 2025-04-15 11:48:10 +02:00
parent 0eab569b91
commit 5c67f2a370
2 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
backend/src/middlewares/auth.middleware.ts
View File

@ -156,8 +156,17 @@ export const allowAnonymous = async (req: Request) => {
}; };
// Limit login attempts to avoid brute force attacks // Limit login attempts to avoid brute force attacks
export const loginLimiter = rateLimit({ const loginLimiter = rateLimit({
windowMs: ms('15m'), windowMs: ms('15m'),
limit: 5, limit: 5,
message: 'Too many login attempts, please try again later' message: 'Too many login attempts, please try again later'
}); });
export const withLoginLimiter = (req: Request, res: Response, next: NextFunction) => {
// Bypass rate limiting in test environment
if (process.env.NODE_ENV === 'test') {
return next();
}
return loginLimiter(req, res, next);
};

4
backend/src/routes/auth.routes.ts
View File

@ -1,7 +1,7 @@
import { Router } from 'express'; import { Router } from 'express';
import bodyParser from 'body-parser'; import bodyParser from 'body-parser';
import * as authCtrl from '../controllers/auth.controller.js'; import * as authCtrl from '../controllers/auth.controller.js';
import { validateLoginRequest, loginLimiter, tokenAndRoleValidator, withAuth } from '../middlewares/index.js'; import { validateLoginRequest, withLoginLimiter, tokenAndRoleValidator, withAuth } from '../middlewares/index.js';
import { UserRole } from '@typings-ce'; import { UserRole } from '@typings-ce';
export const authRouter = Router(); export const authRouter = Router();
@ -9,7 +9,7 @@ authRouter.use(bodyParser.urlencoded({ extended: true }));
authRouter.use(bodyParser.json()); authRouter.use(bodyParser.json());
// Auth Routes // Auth Routes
authRouter.post('/login', validateLoginRequest, loginLimiter, authCtrl.login); authRouter.post('/login', validateLoginRequest, withLoginLimiter, authCtrl.login);
authRouter.post('/logout', authCtrl.logout); authRouter.post('/logout', authCtrl.logout);
authRouter.post('/refresh', authCtrl.refreshToken); authRouter.post('/refresh', authCtrl.refreshToken);
authRouter.get( authRouter.get(