89e546ffd1
Make Rate Limiter Aggressive on statuses > 400 This is based on the hypothesis that the Node application shouldn't be getting hit with a large number of requests in general thanks to Fastly and certainly shouldn't be getting hit with a large number of requests that have status codes greater than 400 unless a user or bot is trying to guess random URLs and as a result. For example, see this IP address that caused some site issues on October 3 Co-authored-by: Chiedo <chiedo@users.noreply.github.com> Co-authored-by: Jason Etcovitch <jasonetco@github.com>
14 lines
442 B
JavaScript
14 lines
442 B
JavaScript
const rateLimit = require('express-rate-limit')
|
|
|
|
const isProduction = process.env.NODE_ENV === 'production'
|
|
|
|
module.exports = rateLimit({
|
|
// 1 minute (or practically unlimited outside of production)
|
|
windowMs: isProduction ? (60 * 1000) : 1,
|
|
// limit each IP to 20 requests per windowMs
|
|
max: 250,
|
|
// Don't rate limit requests for 200s and redirects
|
|
// Or anything with a status code less than 400
|
|
skipSuccessfulRequests: true
|
|
})
|