express-abuse-points

Express.js middleware for tracking and blocking abusive behaviour.

Need to block a user repeatedly entering incorrect passwords into a login form?

Need to stop a user testing invalid product SKUs and coupon codes in an online store?

Need to discourage a user from testing out functions they don't have permission to use?

This middleware is for you!

Installation

npm install @cityssm/express-abuse-points

Usage

It is recommended to include the middleware as early as possible in the middleware chain to enforce the block as soon as possible.

Initializing

import { abuseCheck } from '@cityssm/express-abuse-points'

app.use(abuseCheck())

Recording Abuse

import { recordAbuse } from '@cityssm/express-abuse-points'

if (userDidSomethingBad) {
  recordAbuse(req, 3)
}

API

abuseCheck([options: {}])

The function to include in the Express application setup to initialize the middleware. It accepts the following options.

Property Name	Description	Default Value
byIP	Whether or not abuse points should be tracked by IP address.	true
byXForwardedFor	Whether or not abuse points should be tracked by the X-Forwarded-For header (proxy situations).	false
abusePoints	The default number of points assigned to an abuse event.	1
expiryMillis	The default number of milliseconds an abuse record is enforced before expiring.	300000 (five minutes)
abusePointsMax	The total number of points a user can accumulate before being blocked.	10
clearIntervalMillis	The frequency the memory is cleared of expired abuse records.	3600000

recordAbuse(req: Request, [abusePoints: number, [expiryMillis: number]])

The function to include in the Express handlers to record abusive behaviours.

An optional abusePoints parameter is available if the record should have more or less weight than the default abusePoints.

An optional expiryMillis parameter is available if the record should expiry sooner or later than the default expiryMillis.

isAbuser(req: Request)

Returns true if the given requestor has reached the abuse points threshold.

clearAbuse(req: Request)

Clears all abuse records for the given requestor, expired or not. Helpful if, for example, abuse was tracked for incorrect password attempts, but the user was finally successful.