express-rate-limit 5.3.0 → 5.5.1

package/README.md

@@ -17,6 +17,7 @@ Note: this module does not share state with other processes/servers by default.
 - [Redis Store](https://npmjs.com/package/rate-limit-redis)
 - [Memcached Store](https://npmjs.org/package/rate-limit-memcached)
 - [Mongo Store](https://www.npmjs.com/package/rate-limit-mongo)
+- [Precise Memory Store](https://www.npmjs.com/package/precise-memory-rate-limit) - similar to the built-in memory store except that it stores a distinct timestamp for each IP rather than bucketing them together.
 
 ### Alternate Rate-limiters
 
@@ -39,7 +40,7 @@ For an API-only server where the rate-limiter should be applied to all requests:
 ```js
 const rateLimit = require("express-rate-limit");
 
-// Enable if you're behind a reverse proxy (Heroku, Bluemix, AWS ELB, Nginx, etc)
+// Enable if you're behind a reverse proxy (Heroku, Bluemix, AWS ELB or API Gateway, Nginx, etc)
 // see https://expressjs.com/en/guide/behind-proxies.html
 // app.set('trust proxy', 1);
 
@@ -57,7 +58,7 @@ For a "regular" web server (e.g. anything that uses `express.static()`), where t
 ```js
 const rateLimit = require("express-rate-limit");
 
-// Enable if you're behind a reverse proxy (Heroku, Bluemix, AWS ELB, Nginx, etc)
+// Enable if you're behind a reverse proxy (Heroku, Bluemix, AWS ELB or API Gateway, Nginx, etc)
 // see https://expressjs.com/en/guide/behind-proxies.html
 // app.set('trust proxy', 1);
 
@@ -102,6 +103,8 @@ app.post("/create-account", createAccountLimiter, function(req, res) {
 
 A `req.rateLimit` property is added to all requests with the `limit`, `current`, and `remaining` number of requests and, if the store provides it, a `resetTime` Date object. These may be used in your application code to take additional actions or inform the user of their status.
 
+The property name can be configured with the configuration option `requestPropertyName`
+
 ## Configuration options
 
 ### max
@@ -112,6 +115,31 @@ May be a number, or a function that returns a number or a promise. If `max` is a
 
 Defaults to `5`. Set to `0` to disable.
 
+Example of using a function:
+
+```js
+const rateLimit = require("express-rate-limit");
+
+function isPremium(req) {
+  //...
+}
+
+const limiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  
+  // max could also be an async function or return a promise
+  max: function(req, res) {
+    if (isPremium(req)) {
+      return 10;
+    }
+    return 5;
+  }
+});
+
+//  apply to all requests
+app.use(limiter);
+```
+
 ### windowMs
 
 Timeframe for which requests are checked/remembered. Also used in the Retry-After header when the limit is reached.
@@ -150,7 +178,7 @@ Defaults to `false`. Behavior and name will likely change in future releases.
 
 Function used to generate keys.
 
-Defaults to req.ip:
+Defaults to req.ip, similar to this:
 
 ```js
 function (req /*, res*/) {
@@ -160,14 +188,14 @@ function (req /*, res*/) {
 
 ### handler
 
-The function to handle requests once the max limit is exceeded. It receives the request and the response objects. The "next" param is available if you need to pass to the next middleware.
+The function to handle requests once the max limit is exceeded. It receives the request and the response objects. The "next" param is available if you need to pass to the next middleware. Finally, the options param has all of the options that originally passed in when creating the current limiter and the default values for other options.
 
 The`req.rateLimit` object has `limit`, `current`, and `remaining` number of requests and, if the store provides it, a `resetTime` Date object.
 
 Defaults to:
 
 ```js
-function (req, res, /*next*/) {
+function (req, res, next, options) {
     res.status(options.statusCode).send(options.message);
 }
 ```
@@ -230,6 +258,11 @@ function (/*req, res*/) {
 }
 ```
 
+### requestPropertyName
+Parameter to add to `req`-Object. 
+
+Defaults to `rateLimit`.
+
 ### store
 
 The storage to use when persisting rate limit attempts.

package/lib/express-rate-limit.js

@@ -18,15 +18,21 @@ function RateLimit(options) {
       skipSuccessfulRequests: false, // Do not count successful requests
       // allows to create custom keys (by default user IP is used)
       keyGenerator: function (req /*, res*/) {
+        if (!req.ip) {
+          console.error(
+            "express-rate-limit: req.ip is undefined - you can avoid this by providing a custom keyGenerator function, but it may be indicative of a larger issue."
+          );
+        }
         return req.ip;
       },
       skip: function (/*req, res*/) {
         return false;
       },
-      handler: function (req, res /*, next*/) {
+      handler: function (req, res /*, next, optionsUsed*/) {
         res.status(options.statusCode).send(options.message);
       },
       onLimitReached: function (/*req, res, optionsUsed*/) {},
+      requestPropertyName: "rateLimit", // Parameter name appended to req object
     },
     options
   );
@@ -74,7 +80,7 @@ function RateLimit(options) {
 
           Promise.resolve(maxResult)
             .then((max) => {
-              req.rateLimit = {
+              req[options.requestPropertyName] = {
                 limit: max,
                 current: current,
                 remaining: Math.max(max - current, 0),
@@ -83,7 +89,10 @@ function RateLimit(options) {
 
               if (options.headers && !res.headersSent) {
                 res.setHeader("X-RateLimit-Limit", max);
-                res.setHeader("X-RateLimit-Remaining", req.rateLimit.remaining);
+                res.setHeader(
+                  "X-RateLimit-Remaining",
+                  req[options.requestPropertyName].remaining
+                );
                 if (resetTime instanceof Date) {
                   // if we have a resetTime, also provide the current date to help avoid issues with incorrect clocks
                   res.setHeader("Date", new Date().toUTCString());
@@ -95,7 +104,10 @@ function RateLimit(options) {
               }
               if (options.draft_polli_ratelimit_headers && !res.headersSent) {
                 res.setHeader("RateLimit-Limit", max);
-                res.setHeader("RateLimit-Remaining", req.rateLimit.remaining);
+                res.setHeader(
+                  "RateLimit-Remaining",
+                  req[options.requestPropertyName].remaining
+                );
                 if (resetTime) {
                   const deltaSeconds = Math.ceil(
                     (resetTime.getTime() - Date.now()) / 1000
@@ -152,7 +164,7 @@ function RateLimit(options) {
                     Math.ceil(options.windowMs / 1000)
                   );
                 }
-                return options.handler(req, res, next);
+                return options.handler(req, res, next, options);
               }
 
               next();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "express-rate-limit",
-  "version": "5.3.0",
+  "version": "5.5.1",
   "description": "Basic IP rate-limiting middleware for Express. Use to limit repeated requests to public APIs and/or endpoints such as password reset.",
   "homepage": "https://github.com/nfriedly/express-rate-limit",
   "author": {
@@ -33,16 +33,16 @@
   ],
   "devDependencies": {
     "bluebird": "^3.7.2",
-    "eslint": "^7.19.0",
-    "eslint-config-prettier": "^7.2.0",
-    "eslint-plugin-prettier": "^3.3.1",
+    "eslint": "^7.32.0",
+    "eslint-config-prettier": "^8.3.0",
+    "eslint-plugin-prettier": "^4.0.0",
     "express": "^4.17.1",
-    "husky": "^4.3.8",
-    "mocha": "^8.2.1",
-    "prettier": "^2.2.1",
-    "pretty-quick": "^3.1.0",
-    "sinon": "^9.2.4",
-    "supertest": "^6.1.3"
+    "husky": "^7.0.2",
+    "mocha": "^9.1.2",
+    "prettier": "^2.4.1",
+    "pretty-quick": "^3.1.1",
+    "sinon": "^11.1.2",
+    "supertest": "^6.1.6"
   },
   "scripts": {
     "lint": "eslint .",