Rate limit endpoints that send emails using express middleware

[omarchehab98]

Using the package express-limiter we should make it so that an email can only request a password reset or resending verification up to 3 emails per 15 minutes for example.

Take a look at the snippet below.

    limiter({
      path: '/forgotPassword',
      method: 'post',
      lookup: rateLimitEmailLookup,
      total: 3,
      expire: 15 * 60 * 1000,
      onRateLimited
    })

    limiter({
      path: '/requestActivateEmail',
      method: 'post',
      lookup: rateLimitEmailLookup,
      total: 3,
      expire: 15 * 60 * 1000,
      onRateLimited
    })

function onRateLimited (req, res, next) {
  res.status(429)
  res.json({
    message: 'Too many requests. Please try again later.'
  })
}

function rateLimitEmailLookup (req, res, opts, next) {
  if (req.body && req.body.email) {
    opts.lookup = 'body.email'
  }
  return next()
}

function rateLimitSessionOrIpLookup (req, res, opts, next) {
  const isProxied = req.connection.remoteAddress === '::1' ||
    req.connection.remoteAddress === '::ffff:127.0.0.1'
  if (isProxied) {
    opts.lookup = 'headers.x-forwarded-for'
    opts.total = 120
  } else {
    opts.lookup = 'connection.remoteAddress'
    opts.total = 120
  }
  const user = req.session && req.session.user
  if (user) {
    opts.lookup = 'session.user._id'
    opts.total = 240
  }
  return next()
}

[vinmaster]

Hi, I would like to tackle this issue