Add rate limit to api calls (5000/15min).

cisagov · Mar 6, 2024 · c196f08 · c196f08
1 parent 89fc86d
commit c196f08
Show file tree

Hide file tree

Showing 3 changed files with 24 additions and 0 deletions.
diff --git a/backend/package-lock.json b/backend/package-lock.json
diff --git a/backend/package.json b/backend/package.json
@@ -24,6 +24,7 @@
     "cors": "^2.8.5",
     "date-fns": "^3.3.1",
     "express": "^4.18.1",
+    "express-rate-limit": "^7.2.0",
     "global-agent": "^2.2.0",
     "got": "^11.8.5",
     "handlebars": "^4.7.8",

diff --git a/backend/src/api/app.ts b/backend/src/api/app.ts
@@ -18,6 +18,7 @@ import * as stats from './stats';
 import * as apiKeys from './api-keys';
 import * as reports from './reports';
 import * as savedSearches from './saved-searches';
+import rateLimit from 'express-rate-limit';
 import { createProxyMiddleware } from 'http-proxy-middleware';
 import { UserType } from '../models';
 
@@ -57,6 +58,13 @@ const handlerToExpress = (handler) => async (req, res) => {
 
 const app = express();
 
+app.use(
+  rateLimit({
+    windowMs: 15 * 60 * 1000,
+    limit: 5000
+  })
+); // limit 1000 requests per 15 minutes
+
 app.use(express.json({ strict: false }));
 
 app.use(