Description
Currently, our backend endpoints (specifically the file upload route) are open to potential abuse. Without rate limiting, a malicious user or a script could spam the server with thousands of upload requests, leading to Denial of Service (DoS) or exhausting our server storage and MongoDB database.
We need to implement a mechanism to limit the number of requests a single IP address can make to our sensitive routes within a specific timeframe.
Proposed Solution
- Use the
express-rate-limit middleware to protect the backend API.
- Scope: Focus primarily on the POST /api/files/upload and POST /api/auth/login routes.
- Constraint: Limit a single IP to 5 upload attempts every 15 minutes (this can be adjusted in the .env file).
- Behavior: When a user exceeds the limit, the server should return a 429 Too Many Requests status code with a helpful JSON message.
Description
Currently, our backend endpoints (specifically the file upload route) are open to potential abuse. Without rate limiting, a malicious user or a script could spam the server with thousands of upload requests, leading to Denial of Service (DoS) or exhausting our server storage and MongoDB database.
We need to implement a mechanism to limit the number of requests a single IP address can make to our sensitive routes within a specific timeframe.
Proposed Solution
express-rate-limitmiddleware to protect the backend API.