diff --git a/backend/src/middleware/rate-limiter.middleware.ts b/backend/src/middleware/rate-limiter.middleware.ts index 61079a03..e35081d2 100644 --- a/backend/src/middleware/rate-limiter.middleware.ts +++ b/backend/src/middleware/rate-limiter.middleware.ts @@ -1,10 +1,22 @@ -import { rateLimit } from 'express-rate-limit'; +import { rateLimit, type Options } from 'express-rate-limit'; -export const globalRateLimiter = rateLimit({ +/** + * Shared factory to create an express-rate-limit instance with common configuration. + * + * @param options Configuration options for express-rate-limit + * @returns Express rate limit middleware + */ +export function createRateLimiter(options: Partial) { + return rateLimit({ + standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers + legacyHeaders: false, // Disable the `X-RateLimit-*` headers + ...options, + }); +} + +export const globalRateLimiter = createRateLimiter({ windowMs: 1 * 60 * 1000, // 1 minute max: 100, // Limit each IP to 100 requests per `window` (here, per minute) - standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers - legacyHeaders: false, // Disable the `X-RateLimit-*` headers message: { message: 'Too many requests, please try again later.', status: 429, diff --git a/backend/src/middleware/stream-rate-limiter.middleware.ts b/backend/src/middleware/stream-rate-limiter.middleware.ts index 19fe84a2..4b551a30 100644 --- a/backend/src/middleware/stream-rate-limiter.middleware.ts +++ b/backend/src/middleware/stream-rate-limiter.middleware.ts @@ -1,4 +1,4 @@ -import { rateLimit } from 'express-rate-limit'; +import { createRateLimiter } from './rate-limiter.middleware.js'; import { type Request, type Response, type NextFunction } from 'express'; import type { AuthenticatedRequest } from '../types/auth.types.js'; import logger from '../logger.js'; @@ -22,11 +22,9 @@ export function createStreamRateLimiter( // Read from environment variable, default to 10 if not set const max = options?.max ?? (process.env.STREAM_CREATE_RATE_LIMIT ? parseInt(process.env.STREAM_CREATE_RATE_LIMIT, 10) : 10); - return rateLimit({ + return createRateLimiter({ windowMs, max, - standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers - legacyHeaders: false, // Disable the `X-RateLimit-*` headers message: { error: 'Too many stream creation requests - rate limit exceeded', message: 'You have exceeded the rate limit for stream creation. Please try again later.',