auto-smart-security 1.0.14 → 1.0.15

package/dist/apply-security.js

@@ -30,6 +30,9 @@ function applySecurity(app, options) {
     // Dev mode → skip security
     if (options.mode === 'dev')
         return;
+    const pathViolationMap = new Map();
+    const PATH_VIOLATION_TTL = 60000; // 1 minute
+    const PATH_VIOLATION_LIMIT = 10; // accept 10 violation per minute
     if (options.rateLimit) {
         if (options.trustProxy === undefined) {
             throw new Error('[auto-smart-security] rateLimit requires trustProxy to be a number (e.g. 1). Do NOT use true.');
@@ -96,15 +99,29 @@ function applySecurity(app, options) {
             const path = normalizePath(url);
             return whitelist.some((p) => path === p || path.includes(`${p}`));
         };
+        function recordPathViolation(ip) {
+            const now = Date.now();
+            const entry = pathViolationMap.get(ip);
+            if (!entry || now - entry.ts > PATH_VIOLATION_TTL) {
+                pathViolationMap.set(ip, { count: 1, ts: now });
+                return false; // not block
+            }
+            entry.count++;
+            pathViolationMap.set(ip, entry);
+            return entry.count > PATH_VIOLATION_LIMIT; // block if limit exceeded
+        }
         if (options.pathWhitelist?.length &&
             !isPathAllowed(url, options.pathWhitelist)) {
-            await blacklist.block(ip);
-            options.onBlock?.({
-                ip,
-                reason: 'path-not-allowed',
-                url,
-            });
-            return res.status(403).send('Blocked path');
+            const shouldBlock = recordPathViolation(ip); // check violation count
+            if (shouldBlock) {
+                await blacklist.block(ip);
+                options.onBlock?.({
+                    ip,
+                    reason: 'path-not-allowed',
+                    url,
+                });
+                return res.status(403).send('Blocked path');
+            }
         }
         next();
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-smart-security",
-  "version": "1.0.14",
+  "version": "1.0.15",
   "description": "Production-ready security middleware for Express / NestJS",
   "author": "Hai Vinh <haivinhinspirit@gmail.com>",
   "main": "dist/index.js",