6be1791c62
- Backend: Express.js + PostgreSQL/SQLite with LDAP/AD integration - Frontend: React 18 + Vite + TailwindCSS/DaisyUI - Security fixes applied (2026-07 + 2026-08): - LDAP injection prevention, CSRF protection, HttpOnly cookies - Session hashing (SHA-256), account lockout, rate limiting - Input validation (zod), file upload security, CSP/HSTS headers - V3: express-rate-limit updated (ip-address SSRF fix) - V4: postcss updated (nanoid DoS fix) - V5: Rate-limit on /health endpoint - V6: Session rotation on login (session fixation prevention) - V9: Task values array limit (DoS prevention) - V10: Frontend XSS audit completed - Docker: Multi-stage build, non-root user, PostgreSQL + backup service
46 lines
1.3 KiB
JavaScript
46 lines
1.3 KiB
JavaScript
/**
|
|
* Rate limiting configuration module.
|
|
*
|
|
* Punkt 23: User-level rate limiting for critical endpoints.
|
|
*/
|
|
const rateLimit = require('express-rate-limit');
|
|
|
|
// General API rate limit: 100 requests per minute per IP
|
|
const apiLimiter = rateLimit({
|
|
windowMs: 60 * 1000,
|
|
max: 100,
|
|
standardHeaders: true,
|
|
legacyHeaders: false,
|
|
message: { error: 'Zu viele Anfragen. Bitte später erneut versuchen.' },
|
|
});
|
|
|
|
// Login rate limit: 5 attempts per minute per IP (brute-force protection)
|
|
const loginLimiter = rateLimit({
|
|
windowMs: 60 * 1000,
|
|
max: 5,
|
|
standardHeaders: true,
|
|
legacyHeaders: false,
|
|
message: { error: 'Zu viele Anmeldeversuche. Bitte in 1 Minute erneut versuchen.' },
|
|
});
|
|
|
|
// Punkt 23: Task creation rate limit: 20 per minute per user
|
|
const taskCreateLimiter = rateLimit({
|
|
windowMs: 60 * 1000,
|
|
max: 20,
|
|
standardHeaders: true,
|
|
legacyHeaders: false,
|
|
skip: (req) => !req.user,
|
|
message: { error: 'Zu viele Auftragsanfragen. Bitte später erneut versuchen.' },
|
|
});
|
|
|
|
// Punkt 23: File upload rate limit: 10 per minute per user
|
|
const uploadLimiter = rateLimit({
|
|
windowMs: 60 * 1000,
|
|
max: 10,
|
|
standardHeaders: true,
|
|
legacyHeaders: false,
|
|
skip: (req) => !req.user,
|
|
message: { error: 'Zu viele Upload-Anfragen. Bitte später erneut versuchen.' },
|
|
});
|
|
|
|
module.exports = { apiLimiter, loginLimiter, taskCreateLimiter, uploadLimiter }; |