Improve Provisioning API rate limiting (#458)

* Update express-rate-limit

* Fix rate limiting config and use standard headers

* Tweak default rate limit

* Add changelog

* Add retry_after_ms to error content

Author: justinbot

changelog.d/458.misc

@@ -0,0 +1 @@
+Improve Provisioning API rate limiting and fix response headers.

package.json

@@ -35,7 +35,7 @@
     "axios": "^0.27.2",
     "chalk": "^4.1.0",
     "express": "^4.18.1",
-    "express-rate-limit": "^6.2.0",
+    "express-rate-limit": "^6.7.0",
     "extend": "^3.0.2",
     "ip-cidr": "^3.0.4",
     "is-my-json-valid": "^2.20.5",

src/provisioning/api.ts

@@ -9,7 +9,7 @@ import { MatrixHostResolver } from "../utils/matrix-host-resolver";
 import IPCIDR from "ip-cidr";
 import { isIP } from "net";
 import { promises as dns } from "dns";
-import ratelimiter, { RateLimitInfo, Options as RatelimitOptions, AugmentedRequest } from "express-rate-limit";
+import ratelimiter, { Options as RatelimitOptions } from "express-rate-limit";
 import { Methods } from "./request";
 import { Logger } from "..";
 
@@ -109,7 +109,7 @@ export interface ProvisioningApiOpts {
      * Options for ratelimiting requests to the api server. Does not affect
      * static content loading.
      */
-    ratelimit?: boolean|RatelimitOptions;
+    ratelimit?: boolean|Partial<RatelimitOptions>;
 }
 
 
@@ -145,14 +145,21 @@ export class ProvisioningApi {
         this.app.get('/health', this.getHealth.bind(this));
 
         const limiter = this.opts.ratelimit && ratelimiter({
-            handler: (req, _res, next) => {
-                const info = (req as AugmentedRequest).ratelimit as RateLimitInfo;
-                const retryAfterMs = info?.resetTime ? info.resetTime.getTime() - Date.now() : null;
-                next(new ApiError("Too many requests", ErrCode.Ratelimited, 429, { retry_after_ms: retryAfterMs }));
+            handler: (req, _res, next, options) => {
+                next(new ApiError(
+                    "Too many requests",
+                    ErrCode.Ratelimited,
+                    429,
+                    {
+                        retry_after_ms: options.windowMs,
+                    }
+                ));
             },
-            windowMs: 6 * 60 * 1000, // 5 minutes
-            max: 100, // Limit each IP to 100 requests per `window` (here, per 15 minutes)
-            ...(typeof this.opts.ratelimit === "object" ? this.opts.ratelimit : undefined)
+            windowMs: 1 * 60 * 1000, // 1 minute
+            max: 30, // Limit per window
+            standardHeaders: true,
+            legacyHeaders: false,
+            ...(typeof this.opts.ratelimit === "object" ? this.opts.ratelimit : {})
         });
 
         this.baseRoute = router();

yarn.lock

@@ -1308,10 +1308,10 @@ eventemitter3@^4.0.4:
   resolved "https://registry.yarnpkg.com/eventemitter3/-/eventemitter3-4.0.7.tgz#2de9b68f6528d5644ef5c59526a1b4a07306169f"
   integrity sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw==
 
-express-rate-limit@^6.2.0:
-  version "6.4.0"
-  resolved "https://registry.yarnpkg.com/express-rate-limit/-/express-rate-limit-6.4.0.tgz#b7066afe21157a012ed2b7c9adde386e712485cd"
-  integrity sha512-lxQRZI4gi3qAWTf0/Uqsyugsz57h8bd7QyllXBgJvd6DJKokzW7C5DTaNvwzvAQzwHGFaItybfYGhC8gpu0V2A==
+express-rate-limit@^6.7.0:
+  version "6.7.0"
+  resolved "https://registry.yarnpkg.com/express-rate-limit/-/express-rate-limit-6.7.0.tgz#6aa8a1bd63dfe79702267b3af1161a93afc1d3c2"
+  integrity sha512-vhwIdRoqcYB/72TK3tRZI+0ttS8Ytrk24GfmsxDXK9o9IhHNO5bXRiXQSExPQ4GbaE5tvIS7j1SGrxsuWs+sGA==
 
 express@^4.17.1, express@^4.18.1:
   version "4.18.1"