fix: rate-limiter

SGFGOV · Sep 5, 2023 · e849c08 · e849c08
1 parent eda3333
commit e849c08
Show file tree

Hide file tree

Showing 3 changed files with 280 additions and 120 deletions.
diff --git a/packages/medusa-plugin-strapi-ts/package.json b/packages/medusa-plugin-strapi-ts/package.json
@@ -59,8 +59,8 @@
     "ts-jest": "^27.1.3",
     "ts-loader": "^9.2.6",
     "ts-node": "^10.9.1",
-    "typescript": "^4.9.5",
-    "typeorm": "^0.3.16"
+    "typeorm": "^0.3.16",
+    "typescript": "^4.9.5"
   },
   "peerDependencies": {
     "@medusajs/medusa": "^1.8.2",
@@ -77,10 +77,11 @@
     "body-parser": "^1.19.1",
     "cors": "^2.8.5",
     "express": "^4.17.2",
+    "express-rate-limit": "^6.10.0",
     "generate-password": "^1.7.0",
     "jsonwebtoken": "^9.0.0",
     "medusa-core-utils": "^1.1.37",
     "medusa-test-utils": "^1.1.37",
     "update-notifier": "^6.0.2"
   }
-}
+}
diff --git a/packages/medusa-plugin-strapi-ts/src/api/routes/hooks/index.ts b/packages/medusa-plugin-strapi-ts/src/api/routes/hooks/index.ts
@@ -6,11 +6,18 @@ import cors from 'cors';
 import utils from '../../middleware/utils';
 import { StrapiMedusaPluginOptions } from '../../../types/globals';
 import strapiSignal from '../../controllers/hooks/strapi-signal';
+import rateLimiter from 'express-rate-limit';
 
+const limiter = rateLimiter({
+	max: 5,
+	windowMs: 10000, // 10 seconds
+	message: "You can't make any more requests at the moment. Try again later",
+});
 const hooksRouter = Router();
 export default (app: Router, options: StrapiMedusaPluginOptions) => {
 	app.use('/strapi/hooks', hooksRouter);
 	hooksRouter.use(utils);
+	hooksRouter.use(limiter);
 	const strapiUrl = `${options.strapi_protocol}://${options.strapi_host}:${options.strapi_port}`;
 
 	// Authenticated routes