Rate limit

package.json

@@ -54,6 +54,7 @@
     "date-fns": "^1.30.1",
     "dotenv": "^6.2.0",
     "express": "^4.17.1",
+    "express-rate-limit": "5.5.1",
     "express-react-views": "^0.11.0",
     "express-session": "^1.17.2",
     "forever": "^0.15.3",

src/server.ts

@@ -1,5 +1,6 @@
 import moment from 'moment-timezone'
 import express from 'express'
+import rateLimit from 'express-rate-limit'
 import cors from 'cors'
 import { json } from 'body-parser'
 import { ADMIN_GROUP_NAME, COOKIE_SECRET, SECURE_COOKIE, TZ } from './constants'
@@ -18,6 +19,7 @@ import { getUserFromReq, requireUserMiddleware } from './auth/requireUser'
 import { adminController } from './admin/adminController'
 import { cleanup } from './utils/cleanup'
 import { getKnex } from './knex'
+
 // Set the default timezone for the app
 moment.tz.setDefault(TZ)
 
@@ -63,13 +65,18 @@ type RequestContext = {
 
   const app = express()
 
+  const limiter = rateLimit({
+    windowMs: 1 * 60 * 1000,
+    max: 200,
+  })
+
   app.use(
     cors({
       credentials: true,
       origin: ORIGIN,
     })
   )
-
+  app.use(limiter)
   app.use(json({ limit: '50mb' }))
 
   app.engine('js', createEngine({ transformViews: false }))

yarn.lock

@@ -4170,6 +4170,11 @@ expect@^24.9.0:
     jest-message-util "^24.9.0"
     jest-regex-util "^24.9.0"
 
+express-rate-limit@5.5.1:
+  version "5.5.1"
+  resolved "https://registry.yarnpkg.com/express-rate-limit/-/express-rate-limit-5.5.1.tgz#110c23f6a65dfa96ab468eda95e71697bc6987a2"
+  integrity sha512-MTjE2eIbHv5DyfuFz4zLYWxpqVhEhkTiwFGuB74Q9CSou2WHO52nlE5y3Zlg6SIsiYUIPj6ifFxnkPz6O3sIUg==
+
 express-react-views@^0.11.0:
   version "0.11.0"
   resolved "https://registry.yarnpkg.com/express-react-views/-/express-react-views-0.11.0.tgz#56bfccee57eb8e65fcfb5321c4f377df0f25f174"