Rate Limiting & Sanitization
express-rate-limit EK window (jaise 15 min) mein per-IP requests count karta hai aur limit paar hone par 429 Too Many Requests bhejta hai. Login/OTP endpoints par tight limit brute-force attacks rokti hai.
Sanitization alag concern hai: NoSQL injection se bachne ke liye express-mongo-sanitize aur XSS se bachne ke liye output escaping. SQL ke liye HAMESHA parameterized queries use karo, string concatenation kabhi nahi.
const rateLimit = require("express-rate-limit");
app.use("/api/", rateLimit({ windowMs: 15*60*1000, max: 100 }));
app.use("/api/login", rateLimit({ windowMs: 15*60*1000, max: 5 }));
app.use(require("express-mongo-sanitize")());- express-rate-limit per-IP window-based limit lagakar 429 bhejta hai
- Login/OTP par tight limit brute-force rokti hai
- Proxy ke peeche trust proxy set karo warna real client IP nahi milega
Rate limiter ko do cheezein chahiye: window (kitne time mein) aur max (kitni requests). Default key client IP hoti hai, lekin logged-in users ke liye user id better hai — ek office ke saare log ek hi public IP se aate hain, to IP-based limit sabko saath mein block kar degi.
const limiter = rateLimit({
windowMs: 15 * 60 * 1000,
max: 100,
keyGenerator: (req) => req.user?.id || req.ip,
standardHeaders: true, // RateLimit-* headers bhejo
});Default memory store har instance ka apna counter rakhta hai — 4 instances par effective limit 4 guna ho jaati hai. Multi-instance deployment mein Redis store use karo taaki counter sab instances ke beech shared rahe.
const RedisStore = require("rate-limit-redis");
rateLimit({ store: new RedisStore({ sendCommand: (...a) => redis.call(...a) }),
windowMs: 60000, max: 60 });