socket.io-rate-limiter

A Socket.IO middleware for implementing rate limiting based on token buckets. Prevents excessive requests by enforcing a maximum request rate and provides a configurable grace period for rate-limited users.

Usage

Install the package by typing npm i @d3vision/socket.io-rate-limiter in your project folder.

Setup

1const socketIORateLimiter = require("@d3vision/socket.io-rate-limit");
2
3/* ... get access to socket.io's main object */
4io.on("connection", socket => {
5  // Setup rate limiting middleware
6  socket.use(
7    socketIORateLimiter({ proxy: true, maxBurst: 5, perSecond: 1, gracePeriodInSeconds: 15, emitClientHtmlError: true }, socket)
8  );
9  /* ... your code below */
10});

Methods

socketIORateLimiter

Pass this with the config as an middleware to io.use().

Parameters

• config (ConfigObject)
• socket (SocketIO#Socket)

Returns

• Function (SocketIO#Middleware)

Objects

ConfigObject

Object which holds all configuration values for the middleware.

Example

1const config = {
2  // If the socket server is running behind a proxy (nginx, haproxy, etc.) this is used when getting the client IP from the websocket request.
3  proxy: true,
4
5  // Bucket size (starting amount of tokens in the bucket, each request = -1 token)
6  maxBurst: 5,
7
8  // How many tokens will be added back into the bucket per second
9  perSecond: 1,
10
11  // How many seconds the user will be "jailed" until they can submit requests again
12  gracePeriodInSeconds: 15,
13
14  // Dictates if the `rate_limit_exceeded` event is emited back to the socket containing an error message and the amount of seconds remaining until the grace period has run out
15  emitClientHtmlError: true,
16
17  // Dictates if rate limit hits are logged to the console
18  emitConsoleError: true
19};
20
21io.use(socketIORateLimiter(config));

License

MIT