Ralphi

Ralphi is a simple rate limiting server intended to prevent bruteforce attacks on logins and other sensitive assets. it is very loosely base on limitd but it is much more simple.

Main difference to limitd -

• Memory only. no persistence.
• Simple drip only and frame interval only
• No wait, count or other advance features you can only take or reset a record
• HTTP interface

Ralphi currently has 4 independent npm modules to it

• ralphi - Simple API server for rate limiting, use to store rate limiting data
• ralphi-client - client to easily query the server
• hapi-ralphi - plugin to easily add rate limiting to hapi.js
• express-ralphi - middleware to easily add rate limiting to express.js

Installation

$ npm install -s ralphi
$ npm install -s ralphi-client
# if you wish to use it with hapi install the hapi plugin
$ npm install -s hapi-ralphi

Usage

Start Ralphi server

$ npx ralphi login,5,10m

The above command will start Ralphi with a single login bucket that allows for 5 request every 10 minutes For more information see the Config section or run ralphi --help

Integrate rate limiting in hapi.js

const plugin = require('hapi-ralphi');
const client = new require('ralphi-client')();
const server = new require('hapi').Server();

async function init () {
    await server.register({plugin, options: {client}});
    server.route({
        method: 'POST',
        path: '/login',
        config: {
            plugins: {
                ralphi: {
                    bucket: 'login'
                }
            }
        },
        handler () {
            return 'Success';
        }
    });
}
init();

login root will be rate limited according to the bucket settings, and rate limiting headers will be sent with the response.

For more information see hapi-ralphi

Integrate rate limiting in express js

const express   = require('express');
const app       = express();
const RateLimit = require('express-ralphi');
const client    = new require('ralphi-client')();

app.use('/login', RateLimit({bucket: 'login', client}));
app.get('/login', (rec, res) => res.send('Success'));

login root will be rate limited according to the bucket settings, and rate limiting headers will be sent with the response.

For more information see express-ralphi

Integrate rate limiting in other frameworks

const client = new require('ralphi-client')();

async function handler (req, res) { //in your handler code
    const limit = await client.take('login', req.ip);
    if (limit.conformant) {
        //allow access
        return `Request was done. You have ${limit.remaining} more requests until ${new Date(limit.ttl * 1000)}`;
    } else {
        //reject access
        throw new Error(`You have made too many requests. You can send ${limit.size} requests after ${new Date(limit.ttl * 1000)}`);
    }
}

For more information see ralphi-client

Config

You can use the following command line flags to configure Ralphi -

• -h, --host [localhost] - Ip address or host to listen to. by default ralphi only listen on localhost. if you have reason to listen on an external address make sure it is not publicly accessible.
• -p, --port [8910] - port server will listen on
• l, --log-level [info] - log level (debug,info,error,silent, ralphi will json logs to stdout.
• -i, --clean-interval - if set ralphi will try to remove expired records every X seconds. -c, --config - JSON format config file to be used to load configuration (see the following section for the config file format)

Other than settings the flags Ralphi requires you to define buckets to be used for rate limiting -

$ ralphi login,10,30m token,2,1h

Using the above command Ralphi will start with two buckets defined

• Login bucket allowing for 10 requests ever 30 minutes
• Token bucket allowing for 2 request every hour

bucket name must be alphanumeric and ttl value can have a unit prefix (ms,s,m,h) or it will default to seconds

Config file

Config need to be in a json format.

{
    "host": "localhost",
    "port": 8910,
    "cleanInterval": 1800,
    "buckets": {
        "login": {
            "size": 10,
            "ttl": "30m"
        }
    },
}