diff --git a/API/server.js b/API/server.js index 7a61cd7..2eacb55 100644 --- a/API/server.js +++ b/API/server.js @@ -47,23 +47,32 @@ app.use(express.urlencoded({ extended: true })); // Static file serving app.use(express.static('../Website/dist')); -// Rate limiting +// Rate limiting (more lenient for development) const { RateLimiterMemory } = require('rate-limiter-flexible'); const limiter = new RateLimiterMemory({ keyGenerator: (req) => req.ip, - points: 100, // limit each IP to 100 requests per windowMs - duration: 900, // 15 minutes - blockDuration: 900, // Block for 15 minutes + points: 1000, // limit each IP to 1000 requests per windowMs (increased from 100) + duration: 60, // 1 minute window (reduced from 15 minutes) + blockDuration: 60, // Block for 1 minute (reduced from 15 minutes) }); + app.use('/api/', async (req, res, next) => { try { - const resLimiter = await limiter.consume(req.ip); - if (!resLimiter.remainingPoints) { - return res.status(429).json({ error: 'Too many requests, please try again later.' }); + // Skip rate limiting for localhost in development + const isLocalhost = req.ip === '127.0.0.1' || req.ip === '::1' || req.hostname === 'localhost'; + + if (!isLocalhost) { + const resLimiter = await limiter.consume(req.ip); + if (!resLimiter.remainingPoints) { + return res.status(429).json({ error: 'Too many requests, please try again later.' }); + } } next(); - } catch (error) { - next(); + } catch (rejRes) { + // Handle rate limit exceeded + const secs = Math.round(rejRes.msBeforeNext / 1000) || 1; + res.set('Retry-After', String(secs)); + res.status(429).json({ error: 'Too many requests, please try again later.' }); } });