From d3cf02122cf49db04ff24f72555f75d5ff791c10 Mon Sep 17 00:00:00 2001 From: Chris Troutner Date: Fri, 8 Apr 2022 07:28:12 -0700 Subject: [PATCH 1/2] fix(rate-limits): Further slowing down anon freeloaders --- src/middleware/route-ratelimit.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/middleware/route-ratelimit.js b/src/middleware/route-ratelimit.js index e9ddecf..0a834a6 100644 --- a/src/middleware/route-ratelimit.js +++ b/src/middleware/route-ratelimit.js @@ -35,7 +35,7 @@ const config = require('../../config') // The amount of delay in milliseconds to add to anonymous requests, in order // to slow down freeloaders that are hitting the system too hard. -const ANON_DELAY = 1000 +const ANON_DELAY = 3000 let _this // Global pointer to instance of class, when 'this' context is lost. From 56c52ab6edc744f689668fb4e1c8a9cbd80dcdbc Mon Sep 17 00:00:00 2001 From: Chris Troutner Date: Fri, 8 Apr 2022 07:35:46 -0700 Subject: [PATCH 2/2] Fixing unit tests --- test/v5/rate-limit-unit.js | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/test/v5/rate-limit-unit.js b/test/v5/rate-limit-unit.js index 2b3dd6d..4adbc6a 100644 --- a/test/v5/rate-limit-unit.js +++ b/test/v5/rate-limit-unit.js @@ -204,6 +204,9 @@ describe('#rate-routelimit', () => { describe('#trackRateLimits', () => { it('should apply anonymous rate limits if no JWT token is provided', async () => { + // Mock sleep function + sandbox.stub(uut, 'sleep').resolves() + req.ip = '127.0.0.1' const result = await uut.trackRateLimits(req, res) @@ -278,6 +281,9 @@ describe('#rate-routelimit', () => { }) it('should apply rate limits to anonymous users', async () => { + // Mock sleep function + sandbox.stub(uut, 'sleep').resolves() + req.ip = '123.456.7.8' // console.log('next.callCount: ', next.callCount) @@ -302,6 +308,9 @@ describe('#rate-routelimit', () => { }) it('should return 429 error when anonymous users exceed rate limit', async () => { + // Mock sleep function + sandbox.stub(uut, 'sleep').resolves() + req.ip = '123.456.7.8' // force req.locals.jwtToken to be empty.