hapi-ralphi

hapi plugin for ralphi pure Node.js rate limiting server

Ralphi is a simple rate limiting server intended to prevent bruteforce attacks on logins and other sensitive assets.

For more info about Ralphi other components see ralphi

Plugin Installation

$ npm install -s ralphi-client
$ npm install -s hapi-ralphi

Usage

Integrate rate limiting in hapi.js

const plugin = require('hapi-ralphi');
const client = new require('ralphi-client')();
const server = new require('hapi').Server();

async function init () {
    await server.register({plugin, options: {client}});
    server.route({
        method: 'POST',
        path: '/login',
        config: {
            plugins: {
                ralphi: {
                    bucket: 'login'
                }
            }
        },
        handler () {
            return 'Success';
        }
    });
}
init();

login root will be rate limited according to the bucket settings, and rate limiting headers will be sent with the response.

Configuration Options

• client RalphiClient required - Ralphi client, used to query Ralphi server.
• ext String default(onPreHandler) - request flow hook when plugin should check rate limiting can be one of ('onPreAuth', 'onPostAuth', 'onPreHandler')
• allRoutes Boolean default(false) - if true rate limiting will be enabled by default on all routes
• bucket String - bucket to use for rate limiting (required when allRoutes is true)
• countSuccess Boolean default(true) - if true request are counted even if they are successful, when set to false only request that result in an error will be counted toward rate limiting.
• getKey Function(request) - A Function that will get the unique client key out of the request object. By default request.info.remoteAddress is used.
• addHeaders Boolean default(true) - Add the headers 'X-RateLimit-Limit', 'X-RateLimit-Remaining', 'X-RateLimit-Reset' for routes that enable rate liming
• headerLimit String default('X-RateLimit-Limit') - name of the header that indicates the request quota
• headerRemaining String default('X-RateLimit-Remaining') - name of the header that indicates the remaining request quota
• headerReset String default('X-RateLimit-Reset') - name of the header that indicates how long until the request quota is reset
• ttlTransform Function(ttl) - A Function that allows transformation of the ttl passed down from the Ralphi server.
• message String default('you have exceeded your request limit') - Error message in case limit has exceeded
• onError Function(request, reply, Error) default(undefined) - if communication with Ralphi server results in an error, plugin will call this method and stop processing the request. By default request will be rate limited using errorSize and errorDelay settings errorSize Integer default(1) - default record size if Ralphi server is not available errorDelay Integer default(60) - default delay in seconds to send to the user if Ralphi server is not available

All configuration options other than client,ext,allRoutes can be overridden in the route settings. When allRoutes is false(default), you'll need to set a config object in config.plugins.ralphi to enable the route. If allRoutes is true you can disable a specific route by setting config.plugins.ralphi to false.