ralphi - logo

ralphi

Pure Node.js simple rate limiting server to prevent bruteforce attacks

This project is maintained by yonjah

Ralphi

npm version Build Status codecov Known Vulnerabilities License

Ralphi is a simple rate limiting server intended to prevent bruteforce attacks on logins and other sensitive assets. it is very loosely base on limitd but it is much more simple.

Main difference to limitd -

Ralphi currently has 4 independent npm modules to it

Installation

$ npm install -s ralphi
$ npm install -s ralphi-client
# if you wish to use it with hapi install the hapi plugin
$ npm install -s hapi-ralphi

Usage

Start Ralphi server

$ npx ralphi login,5,10m

The above command will start Ralphi with a single login bucket that allows for 5 request every 10 minutes For more information see the Config section or run ralphi --help

Integrate rate limiting in hapi.js

const plugin = require('hapi-ralphi');
const client = new require('ralphi-client')();
const server = new require('hapi').Server();

async function init () {
    await server.register({plugin, options: {client}});
    server.route({
        method: 'POST',
        path: '/login',
        config: {
            plugins: {
                ralphi: {
                    bucket: 'login'
                }
            }
        },
        handler () {
            return 'Success';
        }
    });
}
init();

login root will be rate limited according to the bucket settings, and rate limiting headers will be sent with the response.

For more information see hapi-ralphi

Integrate rate limiting in express js

const express   = require('express');
const app       = express();
const RateLimit = require('express-ralphi');
const client    = new require('ralphi-client')();

app.use('/login', RateLimit({bucket: 'login', client}));
app.get('/login', (rec, res) => res.send('Success'));

login root will be rate limited according to the bucket settings, and rate limiting headers will be sent with the response.

For more information see express-ralphi

Integrate rate limiting in other frameworks

const client = new require('ralphi-client')();

async function handler (req, res) { //in your handler code
    const limit = await client.take('login', req.ip);
    if (limit.conformant) {
        //allow access
        return `Request was done. You have ${limit.remaining} more requests until ${new Date(limit.ttl * 1000)}`;
    } else {
        //reject access
        throw new Error(`You have made too many requests. You can send ${limit.size} requests after ${new Date(limit.ttl * 1000)}`);
    }
}

For more information see ralphi-client

Config

You can use the following command line flags to configure Ralphi -

Other than settings the flags Ralphi requires you to define buckets to be used for rate limiting -

$ ralphi login,10,30m token,2,1h

Using the above command Ralphi will start with two buckets defined

bucket name must be alphanumeric and ttl value can have a unit prefix (ms,s,m,h) or it will default to seconds

Config file

Config need to be in a json format.

{
    "host": "localhost",
    "port": 8910,
    "cleanInterval": 1800,
    "buckets": {
        "login": {
            "size": 10,
            "ttl": "30m"
        }
    },
}