Pure Node.js simple rate limiting server to prevent bruteforce attacks
This project is maintained by yonjah
This Project is no longer maintained
Ralphi
is a simple rate limiting server intended to prevent bruteforce attacks on logins and other sensitive assets. it is very loosely base on limitd but it is much more simple.
Main difference to limitd
-
take
or reset
a recordRalphi currently has 4 independent npm modules to it
$ npm install -s ralphi
$ npm install -s ralphi-client
# if you wish to use it with hapi install the hapi plugin
$ npm install -s hapi-ralphi
$ npx ralphi login,5,10m
The above command will start Ralphi
with a single login
bucket that allows for 5 request every 10 minutes
For more information see Ralphi server or run ralphi --help
const plugin = require('hapi-ralphi');
const client = new require('ralphi-client')();
const server = new require('hapi').Server();
async function init () {
await server.register({plugin, options: {client}});
server.route({
method: 'POST',
path: '/login',
config: {
plugins: {
ralphi: {
bucket: 'login'
}
}
},
handler () {
return 'Success';
}
});
}
init();
login
root will be rate limited according to the bucket settings, and rate limiting headers will be sent with the response.
For more information see hapi-ralphi
const express = require('express');
const app = express();
const RateLimit = require('express-ralphi');
const client = new require('ralphi-client')();
app.use('/login', RateLimit({bucket: 'login', client}));
app.get('/login', (rec, res) => res.send('Success'));
login
root will be rate limited according to the bucket settings, and rate limiting headers will be sent with the response.
For more information see express-ralphi
const client = new require('ralphi-client')();
async function handler (req, res) { //in your handler code
const limit = await client.take('login', req.ip);
if (limit.conformant) {
//allow access
return `Request was done. You have ${limit.remaining} more requests until ${new Date(limit.ttl * 1000)}`;
} else {
//reject access
throw new Error(`You have made too many requests. You can send ${limit.size} requests after ${new Date(limit.ttl * 1000)}`);
}
}
For more information see ralphi-client