Merge pull request #217 from popcell/feat-auth-limiter

feat: 实现用户登录权限相关接口的限流(登录、注册、发送邮件等等)

Author: Kerwin1202

service/.env.example

@@ -8,7 +8,7 @@ OPENAI_ACCESS_TOKEN=
 OPENAI_API_BASE_URL=
 
 # ChatGPTAPI 或者 ChatGPTUnofficialProxyAPI
-OPENAI_API_MODEL: 
+OPENAI_API_MODEL:
 
 # set `true` to disable OpenAI API debug log
 OPENAI_API_DISABLE_DEBUG=
@@ -24,6 +24,9 @@ TIMEOUT_MS=100000
 # Rate Limit
 MAX_REQUEST_PER_HOUR=
 
+# Auth Rate Limit
+AUTH_MAX_REQUEST_PER_MINUTE=5
+
 # Socks Proxy Host
 SOCKS_PROXY_HOST=
 
@@ -46,7 +49,7 @@ SITE_TITLE="ChatGpt Web"
 # MONGODB_URL=mongodb://chatgpt:xxxx@yourip:port
 MONGODB_URL=mongodb://chatgpt:xxxx@database:27017
 
-# Secret key for jwt 
+# Secret key for jwt
 # If not empty, will need login
 AUTH_SECRET_KEY=
 

service/src/index.ts

@@ -41,7 +41,7 @@ import {
   upsertKey,
   verifyUser,
 } from './storage/mongo'
-import { limiter } from './middleware/limiter'
+import { authLimiter, limiter } from './middleware/limiter'
 import { hasAnyRole, isEmail, isNotEmptyString } from './utils/is'
 import { sendNoticeMail, sendResetPasswordMail, sendTestMail, sendVerifyMail, sendVerifyMailAdmin } from './utils/mail'
 import { checkUserResetPassword, checkUserVerify, checkUserVerifyAdmin, getUserResetPasswordUrl, getUserVerifyUrl, getUserVerifyUrlAdmin, md5 } from './utils/security'
@@ -502,7 +502,7 @@ router.post('/chat-abort', [auth, limiter], async (req, res) => {
   }
 })
 
-router.post('/user-register', async (req, res) => {
+router.post('/user-register', authLimiter, async (req, res) => {
   try {
     const { username, password } = req.body as { username: string; password: string }
     const config = await getCacheConfig()
@@ -633,7 +633,7 @@ router.post('/session', async (req, res) => {
   }
 })
 
-router.post('/user-login', async (req, res) => {
+router.post('/user-login', authLimiter, async (req, res) => {
   try {
     const { username, password } = req.body as { username: string; password: string }
     if (!username || !password || !isEmail(username))
@@ -665,7 +665,7 @@ router.post('/user-login', async (req, res) => {
   }
 })
 
-router.post('/user-send-reset-mail', async (req, res) => {
+router.post('/user-send-reset-mail', authLimiter, async (req, res) => {
   try {
     const { username } = req.body as { username: string }
     if (!username || !isEmail(username))
@@ -682,7 +682,7 @@ router.post('/user-send-reset-mail', async (req, res) => {
   }
 })
 
-router.post('/user-reset-password', async (req, res) => {
+router.post('/user-reset-password', authLimiter, async (req, res) => {
   try {
     const { username, password, sign } = req.body as { username: string; password: string; sign: string }
     if (!username || !password || !isEmail(username))
@@ -771,7 +771,7 @@ router.post('/user-role', rootAuth, async (req, res) => {
   }
 })
 
-router.post('/verify', async (req, res) => {
+router.post('/verify', authLimiter, async (req, res) => {
   try {
     const { token } = req.body as { token: string }
     if (!token)
@@ -799,7 +799,7 @@ router.post('/verify', async (req, res) => {
   }
 })
 
-router.post('/verifyadmin', async (req, res) => {
+router.post('/verifyadmin', authLimiter, async (req, res) => {
   try {
     const { token } = req.body as { token: string }
     if (!token)

service/src/middleware/limiter.ts

@@ -6,11 +6,14 @@ const requestIp = require('request-ip')
 dotenv.config()
 
 const MAX_REQUEST_PER_HOUR = process.env.MAX_REQUEST_PER_HOUR
+const AUTH_MAX_REQUEST_PER_MINUTE = process.env.AUTH_MAX_REQUEST_PER_MINUTE
 
 const maxCount = (isNotEmptyString(MAX_REQUEST_PER_HOUR) && !isNaN(Number(MAX_REQUEST_PER_HOUR)))
   ? parseInt(MAX_REQUEST_PER_HOUR)
   : 0 // 0 means unlimited
-
+const authMaxCount = (isNotEmptyString(AUTH_MAX_REQUEST_PER_MINUTE) && !isNaN(Number(AUTH_MAX_REQUEST_PER_MINUTE)))
+  ? parseInt(AUTH_MAX_REQUEST_PER_MINUTE)
+  : 0 // 0 means unlimited
 const limiter = rateLimit({
   windowMs: 60 * 60 * 1000, // Maximum number of accesses within an hour
   max: maxCount,
@@ -22,5 +25,16 @@ const limiter = rateLimit({
     res.send({ status: 'Fail', message: 'Too many request from this IP in 1 hour', data: null })
   },
 })
+const authLimiter = rateLimit({
+  windowMs: 60 * 1000, // Maximum number of accesses within a minute
+  max: authMaxCount,
+  statusCode: 200, // 200 means success，but the message is 'Too many request from this IP in 1 minute'
+  keyGenerator: (req, _) => {
+    return requestIp.getClientIp(req) // IP address from requestIp.mw(), as opposed to req.ip
+  },
+  message: async (req, res) => {
+    res.send({ status: 'Fail', message: 'About Auth limiter, Too many request from this IP in 1 minute', data: null })
+  },
+})
 
-export { limiter }
+export { limiter, authLimiter }