npmpackage.info

Gathering detailed insights and metrics for rate-limit-mongo

rate-limit-mongo

A MongoDB store for express-rate-limit middleware

2.3.2

JavaScript

Installations

npm install rate-limit-mongo

Pull Requests

Open

4

Total

30

Closed

5

Merged

21

Issues

Open

4

Total

16

Closed

12

Releases

Unable to fetch releases

Developer

2do2go

Developer Guide

BETA

Module System

CommonJS

Min. Node Version

Typescript Support

No

Node Version

14.17.6

NPM Version

6.14.15 Statistics

32 Stars

133 Commits

10 Forks

4 Watching

3 Branches

5 Contributors

Updated on 25 Jan 2023

Languages

JavaScript (100%)

Total Downloads

Cumulative downloads

Total Downloads

2,455,246

Last day

-15.1%

2,161

Compared to previous day

Last week

-4.4%

13,388

Compared to previous week

Last month

-11.3%

56,612

Compared to previous month

Last year

45%

691,310

Compared to previous year

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

mongodb twostep underscore

Dev Dependencies

expect.js jshint mocha nyc rewire sinon

Versions

Rate Limit Mongo

MongoDB store for the express-rate-limit middleware.

Install

1$ npm install --save rate-limit-mongo

Usage

1var RateLimit = require('express-rate-limit');
2var MongoStore = require('rate-limit-mongo');
3
4var limiter = new RateLimit({
5  store: new MongoStore({
6    uri: 'mongodb://127.0.0.1:27017/test_db',
7    user: 'mongouser',
8    password: 'mongopassword',
9    // should match windowMs
10    expireTimeMs: 15 * 60 * 1000,
11    errorHandler: console.error.bind(null, 'rate-limit-mongo')
12    // see Configuration section for more options and details
13  }),
14  max: 100,
15  // should match expireTimeMs
16  windowMs: 15 * 60 * 1000
17});
18
19//  apply to all requests
20app.use(limiter);

Configuration

uri: string -- uri for connecting to mongodb, mongodb://127.0.0.1:27017/test_db for example. Required if collection hasn't been set.
collectionName: string -- name of collection for storing records. Defaults to expressRateRecords
user: string -- username for authentication in mongodb
password: string -- password for authentication in mongodb
authSource: string -- db name against which authenticate use. If not set db name from uri will be taken.
collection: object -- mongodb collection instance. Required if uri hasn't been set.
connectionOptions: object -- mongodb connection options. Allows to pass additional connection options to mongodb. The default connection options are useUnifiedTopology: true, useNewUrlParser: true.
expireTimeMs: integer -- time period, in milliseconds, after which record will be reset (deleted). Defaults to 60 * 1000. Notice that current implementation uses on mongodb ttl indexes - background task that removes expired documents runs every 60 seconds. As a result, documents may remain in a collection during the period between the expiration of the document and the running of the background task. See mongodb ttl indexes doc for more information.

Note: unless express-tate-limit's headers are disabled, windowMs on express-tate-limit's options should be set to the same value as expireTimeMs on rate-limit-mongo's options in order for the Retry-After header to be correct.

resetExpireDateOnChange: boolean -- indicates whether expireDate should be reset when changed or not. Defaults to false.
errorHandler: function -- function that will be called if error happened during incr, decrement or resetKey methods. Defaults to _.noop.
createTtlIndex: boolean -- defines whether create ttl index ( on expirationDate field with expireAfterSeconds: 0) on collection or not. Could be useful in situations when you don't want to create index from the app e.g. due to restricted db permissions (see #15 for details). Defaults to true.

Methods

MongoStore class provides public methods (incr, decrement, resetKey) required by express-rate-limit.

In addition following methods provided:

getClient(callback) - if collection was not passed to the constructor then that method will pass (as second argument) initiated instace of MongoClient to the callback, otherwise null will be passed. Thus this method provides control over connection initiated by the library to the end user. This method is promisified (when util.promisify is presented (node.js >= 8)).

No vulnerabilities found.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

4

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

Reason

dependency not pinned by hash detected -- score normalized to 4

Details

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs-current-lts-linux.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/2do2go/rate-limit-mongo/nodejs-current-lts-linux.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs-current-lts-linux.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/2do2go/rate-limit-mongo/nodejs-current-lts-linux.yml/master?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs-current-lts-linux.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/2do2go/rate-limit-mongo/nodejs-current-lts-linux.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs-current-lts-mac-win.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/2do2go/rate-limit-mongo/nodejs-current-lts-mac-win.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs-current-lts-mac-win.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/2do2go/rate-limit-mongo/nodejs-current-lts-mac-win.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs-legacy.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/2do2go/rate-limit-mongo/nodejs-legacy.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs-legacy.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/2do2go/rate-limit-mongo/nodejs-legacy.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs-main.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/2do2go/rate-limit-mongo/nodejs-main.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs-main.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/2do2go/rate-limit-mongo/nodejs-main.yml/master?enable=pin
Warn: npmCommand not pinned by hash: .github/workflows/nodejs-legacy.yml:23
Info: 0 out of 8 GitHub-owned GitHubAction dependencies pinned
Info: 0 out of 1 third-party GitHubAction dependencies pinned
Info: 3 out of 4 npmCommand dependencies pinned

1

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

Maintained

Determines if the project is "actively maintained".

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Security-Policy

Determines if the project has published a security policy.

0

Fuzzing

Determines if the project uses fuzzing.

0

License

Determines if the project has defined a license.

0

Branch-Protection

Determines if the default and release branches are protected with GitHub's branch protection settings.

0

SAST

Determines if the project uses static code analysis.

0

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

Score

2.5

/10

Last Scanned on 2024-11-25

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More