Implementing Secure Authentication with Rate Limiting | CodeSignal Learn

Implementing Secure Authentication with Rate Limiting | CodeSignal Learn

Introduction to Secure Authentication and Rate Limiting

Welcome back! In the previous lesson, we explored the fundamentals of secure password storage and authentication. We learned about the importance of hashing passwords using the bcryptjs library to ensure that user credentials are stored securely. Now, we will build on that foundation by introducing the concept of rate limiting, a crucial technique to enhance the security of your web applications. Rate limiting is a strategy used to control the number of requests a user can make to a server within a specific time frame. This is particularly important for authentication endpoints, as it helps prevent brute force attacks where an attacker tries multiple password combinations to gain unauthorized access. By the end of this lesson, you'll be able to implement rate limiting in your authentication process to protect against such attacks.

Recap of Initial Setup

Before we dive into rate limiting, let's quickly recap the initial setup of our Pastebin application. This will ensure that we are all on the same page. Here's a brief reminder of how we set up our Express application: TypeScript import express from 'express'; import session from 'express-session'; const app = express(); app.use(express.json()); app.use(session({ secret: 'your-secret-key', resave: false, saveUninitialized: true })); // Your routes will go here app.listen(3000, () => {console.log('Server is running on port 3000');}); In this setup, we import the necessary modules, create an Express app, and configure session management. This forms the foundation upon which we will build our authentication and rate limiting logic.

Understanding Rate Limiting

Rate limiting is a technique used to control the number of requests a client can make to a server within a specified time period. It is a crucial security measure to prevent abuse and protect your application from attacks such as brute force attempts on login endpoints. By limiting the number of login attempts, you can reduce the risk of unauthorized access. For example, you might allow a maximum of 5 login attempts within a 15-minute window. If a user exceeds this limit, they will be temporarily blocked from making further attempts.

Implementing Rate Limiting with Express-Rate-Limit

Sign up

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

To implement rate limiting in our application, we will use the express-rate-limit library. This library provides a simple way to set up rate limiting for your Express routes. First, ensure that you have the library installed. If you're working on your own device, you can install it using npm: npm add express-rate-limit In the CodeSignal environment, this library is pre-installed, so you don't need to worry about installation there. Now, let's set up rate limiting for our login route: import rateLimit from 'express-rate-limit'; // Rate limit: Max 5 login attempts per 15 minutes const loginLimiter = rateLimit({windowMs: 15 * 60 * 1000, // 15 minutes max: 5, // Limit each IP to 5 requests per windowMs message: { error: "Too many login attempts, try again later." }}); Here, loginLimiter is a simple Express middleware—just like any other middleware you might use in your routes. It checks the number of requests and blocks further attempts if the limit is exceeded. There’s no magic involved; you simply attach it to your route to enforce rate limiting. In this code, we set up a rate limiter using express-rate-limit . We define a 15-minute window during which a maximum of 5 login attempts is allowed. The rate limiting is enforced based on the client's IP address. If an IP address surpasses this limit, it will be temporarily restricted from making additional attempts. When the rate limit is breached, the server returns an HTTP status code of 429 (Too Many Requests), indicating that the user has exceeded the allowed number of requests in the specified time frame.

Integrating Rate Limiting into the Authentication Process

Now that we have set up rate limiting, let's integrate it into our existing authentication logic. Here's how you can modify the login route to include rate limiting: router.post('/login', loginLimiter, async (req, res) => {const { username, password } = req.body; const user = await User.findOne({ where: { username } }); if (user && await bcrypt.compare(password, user.password)) {req.session.userId = user.id; return res.json({ message: 'Login successful' });} return res.status(401).json({ error: 'Invalid credentials' });}); In this updated login route, we apply the loginLimiter middleware to enforce rate limiting. The rest of the login logic remains the same, where we verify the user's credentials and establish a session upon successful login.

TypeScript

import rateLimit from 'express-rate-limit';

// Rate limit: Max 5 login attempts per 15 minutes
const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 5, // Limit each IP to 5 requests per windowMs
  message: { error: "Too many login attempts, try again later." }
});

TypeScript

router.post('/login', loginLimiter, async (req, res) => {
  const { username, password } = req.body;
  const user = await User.findOne({ where: { username } });

  if (user && await bcrypt.compare(password, user.password)) {
    req.session.userId = user.id;
    return res.json({ message: 'Login successful' });
  }
  return res.status(401).json({ error: 'Invalid credentials' });
});