From 0699395e6fbba4e61e08305d15123a1e7dfa29dc Mon Sep 17 00:00:00 2001
From: Adam Soltys <asoltys@gmail.com>
Date: Mon, 10 May 2021 12:51:59 -0400
Subject: rate limit socket logins

---
 lib/sockets.js | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'lib')

diff --git a/lib/sockets.js b/lib/sockets.js
index 25f8aed8..b6a806ff 100644
--- a/lib/sockets.js
+++ b/lib/sockets.js
@@ -1,6 +1,8 @@
 const jwt = require("jsonwebtoken");
 const uuidv4 = require("uuid/v4");
 const WebSocket = require("ws");
+const { differenceInSeconds, subSeconds } = require("date-fns");
+
 
 wss = new WebSocket.Server({ clientTracking: false, noServer: true });
 
@@ -8,6 +10,7 @@ wss = new WebSocket.Server({ clientTracking: false, noServer: true });
 const pick = (O, ...K) => K.reduce((o, k) => ((o[k] = O[k]), o), {});
 const all = {};
 const subscriptions = [];
+const lastSeen = {};
 
 emit = (username, type, data) => {
   if (data.username !== undefined) data = pick(data, ...whitelist);
@@ -88,6 +91,11 @@ wss.on("connection", function(ws, req) {
 
       case "login":
         let token = data;
+
+        if (differenceInSeconds(new Date(), subSeconds(lastSeen[token], 5)) < 2) return;
+        lastSeen[token] = new Date();
+
+
         try {
           if (!token || token === "null") return ws.close();
           const username = jwt.decode(token).username;
-- 
cgit v1.2.3