Limit failed attempts with BLOCKED

Total.js 5 · total5@0.0.19 securityrate-limiting Executed against Total.js 5

BLOCKED($, limit, expiration) counts calls per IP address. It returns true once the address has made more than limit calls within the expiration (default: 5 calls in 15 minutes), and undefined before that. Call it at the start of a sensitive handler and stop when it returns true. To forgive an address after a successful login call BLOCKED($, -1).

The counters live in the memory of the process; behind a reverse proxy make sure the real client address reaches Total.js, otherwise everybody shares one counter.

controllers/login.js

exports.install = function() {
	ROUTE('POST /login/', login);
};

function login($) {

	if (BLOCKED($, 3, '1 minute')) {
		$.invalid(429);
		return;
	}

	if ($.body.password === 'correct') {
		BLOCKED($, -1);
		$.json({ ok: true });
	} else
		$.invalid(401);
}