Feat. Added rate limiting

src/index.js

@@ -1,15 +1,68 @@
 require('dotenv').config();
 const express = require('express');
 const path    = require('path');
+const helmet  = require('helmet');
+const rateLimit = require('express-rate-limit');
 const { ensureBucket } = require('./lib/minio');
 const pastesRouter     = require('./routes/pastes');
 
 const app  = express();
 const PORT = process.env.PORT || 3000;
 
+function envInt(name, fallback) {
+  const raw = process.env[name];
+  if (!raw) {
+    return fallback;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+
+const READ_LIMIT_WINDOW_MS = envInt('RATE_LIMIT_READ_WINDOW_MS', 60 * 1000);
+const READ_LIMIT_MAX = envInt('RATE_LIMIT_READ_MAX', 240);
+const CREATE_LIMIT_WINDOW_MS = envInt('RATE_LIMIT_CREATE_WINDOW_MS', 10 * 60 * 1000);
+const CREATE_LIMIT_MAX = envInt('RATE_LIMIT_CREATE_MAX', 40);
+
+app.disable('x-powered-by');
+
+// If deployed behind a reverse proxy/load balancer, set TRUST_PROXY=true.
+if (process.env.TRUST_PROXY === 'true') {
+  app.set('trust proxy', 1);
+}
+
+app.use(helmet({
+  contentSecurityPolicy: false,
+  crossOriginEmbedderPolicy: false,
+}));
+
+const createPasteLimiter = rateLimit({
+  windowMs: CREATE_LIMIT_WINDOW_MS,
+  max: CREATE_LIMIT_MAX,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { error: 'Too many paste creations. Try again later.' },
+});
+
+const readPasteLimiter = rateLimit({
+  windowMs: READ_LIMIT_WINDOW_MS,
+  max: READ_LIMIT_MAX,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { error: 'Too many requests. Slow down.' },
+});
+
 app.use(express.json({ limit: '110kb' }));
+app.use(express.urlencoded({ extended: false, limit: '110kb' }));
 app.use(express.static(path.join(__dirname, 'public')));
 
+app.use('/api/pastes', readPasteLimiter);
+app.use('/api/pastes', (req, res, next) => {
+  if (req.method === 'POST') {
+    return createPasteLimiter(req, res, next);
+  }
+  next();
+});
+
 app.use('/api/pastes', pastesRouter);
 
 // Serve the view page for any paste URL