rate limit socket logins

1 files changed, 8 insertions, 0 deletions

diff --git a/lib/sockets.js b/lib/sockets.js
index 25f8aed8..b6a806ff 100644
--- a/lib/sockets.js
+++ b/lib/sockets.js
@@ -1,6 +1,8 @@
 const jwt = require("jsonwebtoken");
 const uuidv4 = require("uuid/v4");
 const WebSocket = require("ws");
+const { differenceInSeconds, subSeconds } = require("date-fns");
+
 
 wss = new WebSocket.Server({ clientTracking: false, noServer: true });
 
@@ -8,6 +10,7 @@ wss = new WebSocket.Server({ clientTracking: false, noServer: true });
 const pick = (O, ...K) => K.reduce((o, k) => ((o[k] = O[k]), o), {});
 const all = {};
 const subscriptions = [];
+const lastSeen = {};
 
 emit = (username, type, data) => {
   if (data.username !== undefined) data = pick(data, ...whitelist);
@@ -88,6 +91,11 @@ wss.on("connection", function(ws, req) {
 
       case "login":
         let token = data;
+
+        if (differenceInSeconds(new Date(), subSeconds(lastSeen[token], 5)) < 2) return;
+        lastSeen[token] = new Date();
+
+
         try {
           if (!token || token === "null") return ws.close();
           const username = jwt.decode(token).username;