updated temp user control access and limited data send for temps
This commit is contained in:
@@ -40,8 +40,29 @@ const authLimiter = rateLimit({
|
||||
skipSuccessfulRequests: true
|
||||
});
|
||||
|
||||
// Temp user rate limiter - much stricter limits
|
||||
const tempUserLimiter = rateLimit({
|
||||
windowMs: 15 * 60 * 1000, // 15 minutes
|
||||
max: 10, // Much lower limit for temp users
|
||||
keyGenerator,
|
||||
standardHeaders: true,
|
||||
legacyHeaders: false,
|
||||
trustProxy: true,
|
||||
message: 'Too many requests for temporary account. Please contact an administrator for full access.'
|
||||
});
|
||||
|
||||
// Conditional rate limiter that applies stricter limits to temp users
|
||||
const conditionalTempLimiter = (req, res, next) => {
|
||||
if (req.session?.userType === 'temp') {
|
||||
return tempUserLimiter(req, res, next);
|
||||
}
|
||||
return apiLimiter(req, res, next);
|
||||
};
|
||||
|
||||
module.exports = {
|
||||
apiLimiter,
|
||||
strictLimiter,
|
||||
authLimiter
|
||||
authLimiter,
|
||||
tempUserLimiter,
|
||||
conditionalTempLimiter
|
||||
};
|
||||
Reference in New Issue
Block a user