limitd/limitd

simple daemon for rate limit

README

This package is deprecated and should not be used

limitd's Issues

Rename close to stop in server

custom interval configuration

The current options for interval are per_second, per_minute, per_hour and per_day. Can we include a custom interval?
E.g
per_custom_interval: 300s

Change clazz to type

Upgrade Node.js for security fixes #security-nodejs-20160209

Please upgrade Node.js to v0.12.10, v4.3.0, v5.6.0, or newer, to address the security issues listed here:
https://groups.google.com/forum/#!topic/nodejs-sec/G8IA0G4uA88.

Due date for this request is 2016-02-26.

This update addresses the following issues:

• CVE-2016-2086 Request Smuggling Vulnerability
• CVE-2016-2216 Response Splitting Vulnerability
• OpenSSL upgrades and improvements

Please acknowledge that you've received this request and that it makes sense.
If it's not applicable to your repo, let me know so I can fix my list.

Thank you!

Node Dependency MIA

When running the server setup from the readme npm i -g limitd one of the dependencies it tries to pull in is gcstats which yields a 403 from the source it tries to pull https://node-binaries.s3.amazonaws.com/gcstats/v1.0.2/Release/node-v64-darwin-x64.tar.gz . (tried with Node 8 and 10.24.1)

Expose server via require

Useful for automated tests

npm install fails

npm http 404 https://registry.npmjs.org/auth0-instrumentation
npm ERR! TypeError: Object.keys called on non-object
npm ERR!     at Function.keys (native)
npm ERR!     at installTargetsError (/usr/share/npm/lib/cache.js:708:24)
npm ERR!     at /usr/share/npm/lib/cache.js:638:10
npm ERR!     at saved (/usr/share/npm/node_modules/npm-registry-client/lib/get.js:142:7)
npm ERR!     at /usr/lib/nodejs/graceful-fs/polyfills.js:133:7
npm ERR!     at Object.oncomplete (fs.js:107:15)
npm ERR! If you need help, you may report this log at:
npm ERR!     <http://github.com/isaacs/npm/issues>
npm ERR! or email it to:
npm ERR!     <[email protected]>

npm ERR! System Linux 3.8.11
npm ERR! command "/usr/bin/nodejs" "/usr/bin/npm" "install" "."
npm ERR! cwd /home/seppo/Projects/limitd
npm ERR! node -v v0.10.25
npm ERR! npm -v 1.3.10
npm ERR! type called_on_non_object
npm ERR! Error: No compatible version found: protobufjs@'github:jfromaniello/protobuf.js#v5.1.0'
npm ERR! Valid install targets:
npm ERR! ["0.0.0","0.9.1","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","0.9.10","0.9.11","0.9.12","0.9.13","0.10.0","0.11.0","0.11.1","0.11.2","0.12.0","0.12.1","0.12.2","0.12.3","0.12.4","0.12.5","0.12.6","0.12.7","0.12.8","0.12.9","0.12.10","0.12.11","0.12.12","0.12.13","1.0.0-b1","1.0.0-b2","1.0.0-b4","1.0.0-b5","1.0.0-b6","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.6","1.1.7","1.1.8","1.1.9","1.3.0","1.3.1","1.3.2","1.5.0","1.5.1","2.0.0-rc1","2.0.0-rc2","2.0.0-rc4","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.2.1","3.0.0","3.2.0","3.2.1","3.2.2","3.2.4","3.3.0","3.3.1","3.4.0","3.4.1","3.5.1","3.5.2","3.5.4","3.5.5","3.6.0","3.7.0","3.8.0","3.8.1","3.8.2","4.0.0-b2","4.0.0-b3","4.0.0-b4","4.0.0-b5","4.0.0","4.1.0","4.1.1","4.1.2","5.0.0","4.1.3","5.0.1"]
npm ERR!     at installTargetsError (/usr/share/npm/lib/cache.js:719:10)
npm ERR!     at /usr/share/npm/lib/cache.js:638:10
npm ERR!     at saved (/usr/share/npm/node_modules/npm-registry-client/lib/get.js:142:7)
npm ERR!     at /usr/lib/nodejs/graceful-fs/polyfills.js:133:7
npm ERR!     at Object.oncomplete (fs.js:107:15)
npm ERR! If you need help, you may report this log at:
npm ERR!     <http://github.com/isaacs/npm/issues>
npm ERR! or email it to:
npm ERR!     <[email protected]>

npm ERR! System Linux 3.8.11
npm ERR! command "/usr/bin/nodejs" "/usr/bin/npm" "install" "."
npm ERR! cwd /home/seppo/Projects/limitd
npm ERR! node -v v0.10.25
npm ERR! npm -v 1.3.10
npm ERR! 
npm ERR! Additional logging details can be found in:
npm ERR!     /home/seppo/Projects/limitd/npm-debug.log
npm ERR! not ok code 0

graceful shutdowns

Improve handling of the SIGTERM signal, wait until the connection to the database is completely closed.

Publish v6

The release was done only in GitHub but never published to npm. Latest version on npm is 5.11.0.

auth0-instrumentation repo is archived and the replacement repo doesn't exist?

limitd depends on github:auth0/auth0-instrumentation.

This repo is archived: https://github.com/auth0/auth0-instrumentation
The latest PR/commit (auth0/auth0-instrumentation#242) points at a new repo: https://github.com/auth0/instrumentation

However, this new repo doesn't exist?

use lexicographical indexes instead of SCAN

STATUS requests are very slow when using the redis backend. This happens because we are using SCAN.

We should use lexicographical indexes as explained in this page:

http://redis.io/topics/indexes

client.take() order guarantee?

Is there guarantee that if two clients call the take() method when there are no tokens available that they will be allowed to continue in the same order they requested?

Document API methods and parameters

Validate options/settings schema + values

Allow client to close connections

Consider an "observe" only mode

Consider an observe only mode for limitd (or specific buckets) that would allow you to see what the impact of turning on limitd in existing systems would be. This might let you tune things before enabling potentially customer impacting limits.

Suggestions for HA deployment?

Is there any way of deploying multiple limitd servers and make the client switch from one server to another in case the first one goes down?

Thanks!

Setup travis

Implement composite bucket

Let's say you want someone to have the ability to burst to 50 req/sec for a while but then go down to 10 req/sec. This can be implemented with two buckets and using the min:

size: 3000
per_minute: 600

and also:

per_second: 40

And then:

const res1 = take('per_sec_bucket', 'identifier');
const res2 = take('per_min_bucket', 'identifier');
if (res1.sucess && res2.success){ /* let them through */ }

This is doable in the client consuming limitd, but requires additional math to report headers correctly. A composite bucket would help with this.

Response parameter 'reset' does not correspond to README

The README says:

reset: Number: A UNIX timestamp of the expected time at which the bucket will be full again

A response on requesting tokens from the ip bucket described in limitd.yml in the examples folder:

{
  conformant: true,
  delayed: false,
  remaining: 0,
  reset: 23787223,
  limit: 10
}

Clearly reset isn't a UNIX timestamp, it would correspond to Sat, 03 Oct 1970 07:33:43 GMT

I'm using the latest release: v4.1.1

Make tests cross platform

There is a test that does not use path.join and concatenates instead.