node.js limit number of requests from a user

Question

I'm building an app in node.js that allows users to upload documents using express and busboy. The user can upload multiple documents in one upload but is limited to a total file size of 20mb.

Is it possible to prevent a user from making multiple upload requests in a given amount of time? My concern is that someone could easily write a script to upload 20mb (the limit per upload) and repeat this 100x a minute or some large amount. It would be ideal to have a user only be able to upload once every 30 seconds or minute.

I believe you ultimately want some kind of [rate-limiting](https://en.wikipedia.org/wiki/Rate_limiting)... — Robert Rossmann, Jul 14 '16 at 22:50

score 3 · Answer 1 · answered Jan 06 '17 at 23:36

3

If you'd like to rate-limit by IP, this module adds various configurations including the ability to apply the rule by path (example your upload function):

https://www.npmjs.com/package/express-rate-limit

answered Jan 06 '17 at 23:36

Dean Liu

501
5
12

score 2 · Answer 2 · answered Jun 10 '18 at 05:59

I'd suggest rate-limiter-flexible package

const { RateLimiterMemory } = require('rate-limiter- 
flexible');

const rateLimiter = new RateLimiterMemory(
{
  points: 1,
  duration: 30, // per 30 seconds
});

const rateLimiterMiddleware = (req, res, next) => {
  const userId = getUserId();
  // Consume 1 point for each action
  rateLimiter.consume(userId) // or req.ip
    .then(() => {
      next();
    })
    .catch((rejRes) => {
      res.status(429).send('Too Many Requests');
    });
};

app.use('/upload', rateLimiterMiddleware);

Memory works in current process memory only. There are also Cluster, Mongo and Redis limiters for cluster and distributed apps

score 1 · Answer 3 · answered Jul 14 '16 at 22:41

You could implement this in a number of ways, but I think probably the approach that makes the most sense to me is to have either a total upload limit per user, or some sort of date field that indicates when a specific user could upload a new set of files.

If you could provide some more details about your stack, I could probably help bang some code out.

score 0 · Answer 4 · answered Jul 15 '16 at 04:15

You can use middleware to check it

app.use('/upload', upload-middleware, req-res-func)
upload-middleware receive req, calc user by cookies/session-id/etc and stored last upload time. If current request time and prev time is match then call next() to forwarding request to req-res-function else call next(new Error('Upload error...')).

node.js limit number of requests from a user

4 Answers4