express-rate-limit 5.2.2 → 5.3.0

package/README.md

@@ -1,8 +1,7 @@
 # Express Rate Limit
 
-[![Build Status](https://secure.travis-ci.org/nfriedly/express-rate-limit.png?branch=master)](http://travis-ci.org/nfriedly/express-rate-limit)
-[![NPM version](http://badge.fury.io/js/express-rate-limit.png)](https://npmjs.org/package/express-rate-limit "View this project on NPM")
-[![Dependency Status](https://david-dm.org/nfriedly/express-rate-limit.png?theme=shields.io)](https://david-dm.org/nfriedly/express-rate-limit)
+[![Node.js CI](https://github.com/nfriedly/express-rate-limit/workflows/Node.js%20CI/badge.svg)](https://github.com/nfriedly/express-rate-limit/actions)
+[![NPM version](https://img.shields.io/npm/v/express-rate-limit.svg)](https://npmjs.org/package/express-rate-limit "View this project on NPM")
 [![npm downloads](https://img.shields.io/npm/dm/express-rate-limit)](https://www.npmjs.com/package/express-rate-limit)
 
 
@@ -10,12 +9,11 @@ Basic rate-limiting middleware for Express. Use to limit repeated requests to pu
 
 Plays nice with [express-slow-down](https://www.npmjs.com/package/express-slow-down).
 
-Note: this module does not share state with other processes/servers by default.
-If you need a more robust solution, I recommend using an external store:
+Note: this module does not share state with other processes/servers by default. It also buckets all requests to an internal clock rather than starting a new timer for each end-user. It's fine for abuse-prevention but might not produce the desired effect when attempting to strictly enforce API rate-limits or similar. If you need a more robust solution, I recommend using an external store:
 
 ### Stores
 
-- Memory Store _(default, built-in)_ - stores hits in-memory in the Node.js process. Does not share state with other servers or processes.
+- Memory Store _(default, built-in)_ - stores hits in-memory in the Node.js process. Does not share state with other servers or processes, and does not start a separate timer for each end user.
 - [Redis Store](https://npmjs.com/package/rate-limit-redis)
 - [Memcached Store](https://npmjs.org/package/rate-limit-memcached)
 - [Mongo Store](https://www.npmjs.com/package/rate-limit-mongo)
@@ -188,6 +186,19 @@ function (req, res, options) {
 }
 ```
 
+### requestWasSuccessful
+
+Function that is called when `skipFailedRequests` and/or `skipSuccessfulRequests` are set to `true`.
+May be overridden if, for example, a service sends out a 200 status code on errors.
+
+Defaults to
+
+```js
+function (req, res) {
+    return res.statusCode < 400;
+}
+```
+
 ### skipFailedRequests
 
 When set to `true`, failed requests won't be counted. Request considered failed when:

package/lib/express-rate-limit.js

@@ -10,8 +10,12 @@ function RateLimit(options) {
       statusCode: 429, // 429 status = Too Many Requests (RFC 6585)
       headers: true, //Send custom rate limit header with limit and remaining
       draft_polli_ratelimit_headers: false, //Support for the new RateLimit standardization headers
-      skipFailedRequests: false, // Do not count failed requests (status >= 400)
-      skipSuccessfulRequests: false, // Do not count successful requests (status < 400)
+      // ability to manually decide if request was successful. Used when `skipSuccessfulRequests` and/or `skipFailedRequests` are set to `true`
+      requestWasSuccessful: function (req, res) {
+        return res.statusCode < 400;
+      },
+      skipFailedRequests: false, // Do not count failed requests
+      skipSuccessfulRequests: false, // Do not count successful requests
       // allows to create custom keys (by default user IP is used)
       keyGenerator: function (req /*, res*/) {
         return req.ip;
@@ -82,7 +86,7 @@ function RateLimit(options) {
                 res.setHeader("X-RateLimit-Remaining", req.rateLimit.remaining);
                 if (resetTime instanceof Date) {
                   // if we have a resetTime, also provide the current date to help avoid issues with incorrect clocks
-                  res.setHeader("Date", new Date().toGMTString());
+                  res.setHeader("Date", new Date().toUTCString());
                   res.setHeader(
                     "X-RateLimit-Reset",
                     Math.ceil(resetTime.getTime() / 1000)
@@ -114,7 +118,7 @@ function RateLimit(options) {
 
                 if (options.skipFailedRequests) {
                   res.on("finish", function () {
-                    if (res.statusCode >= 400) {
+                    if (!options.requestWasSuccessful(req, res)) {
                       decrementKey();
                     }
                   });
@@ -130,7 +134,7 @@ function RateLimit(options) {
 
                 if (options.skipSuccessfulRequests) {
                   res.on("finish", function () {
-                    if (res.statusCode < 400) {
+                    if (options.requestWasSuccessful(req, res)) {
                       options.store.decrement(key);
                     }
                   });
@@ -152,9 +156,13 @@ function RateLimit(options) {
               }
 
               next();
+
+              return null;
             })
             .catch(next);
         });
+
+        return null;
       })
       .catch(next);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "express-rate-limit",
-  "version": "5.2.2",
+  "version": "5.3.0",
   "description": "Basic IP rate-limiting middleware for Express. Use to limit repeated requests to public APIs and/or endpoints such as password reset.",
   "homepage": "https://github.com/nfriedly/express-rate-limit",
   "author": {
@@ -31,17 +31,18 @@
     "brute-force",
     "attack"
   ],
-  "dependencies": {},
   "devDependencies": {
-    "eslint": "^6.8.0",
-    "eslint-config-prettier": "^6.10.1",
-    "eslint-plugin-prettier": "^3.1.2",
+    "bluebird": "^3.7.2",
+    "eslint": "^7.19.0",
+    "eslint-config-prettier": "^7.2.0",
+    "eslint-plugin-prettier": "^3.3.1",
     "express": "^4.17.1",
-    "husky": "^4.2.3",
-    "mocha": "^7.1.1",
-    "prettier": "^2.0.4",
-    "pretty-quick": "^2.0.1",
-    "supertest": "^4.0.2"
+    "husky": "^4.3.8",
+    "mocha": "^8.2.1",
+    "prettier": "^2.2.1",
+    "pretty-quick": "^3.1.0",
+    "sinon": "^9.2.4",
+    "supertest": "^6.1.3"
   },
   "scripts": {
     "lint": "eslint .",