diff --git a/server/admin.api.js b/server/admin.api.js index 30ed47369..4e6f52246 100644 --- a/server/admin.api.js +++ b/server/admin.api.js @@ -3,38 +3,27 @@ const router = require('express').Router(); const Moment = require('moment'); const templateFn = require('../client/template.js'); const zlib = require('zlib'); -const rateLimit = require('express-rate-limit'); - -// Define rate limiter options -const loginLimiter = rateLimit({ - timeWindow : 24 * 60 * 60 * 1000, // 24 hours window - max : 10, // limit each IP to 10 requests per timeWindow - handler : ()=>{throw { HBErrorCode: '54', code: 470, message: 'Too many failed login attempts, try again later' }; } -}); //Local version username and password process.env.ADMIN_USER = process.env.ADMIN_USER || 'admin'; process.env.ADMIN_PASS = process.env.ADMIN_PASS || 'password3'; const mw = { - adminOnly : [ - loginLimiter, - (req, res, next)=>{ - if(!req.get('authorization')) { - return res - .set('WWW-Authenticate', 'Basic realm="Authorization Required"') - .status(401) - .send('Authorization Required'); - } - const [username, password] = Buffer.from(req.get('authorization').split(' ').pop(), 'base64') - .toString('ascii') - .split(':'); - if(process.env.ADMIN_USER === username && process.env.ADMIN_PASS === password) { - return next(); - } - throw { HBErrorCode: '52', code: 401, message: 'Access denied' }; + adminOnly : (req, res, next)=> { + if(!req.get('authorization')) { + return res + .set('WWW-Authenticate', 'Basic realm="Authorization Required"') + .status(401) + .send('Authorization Required'); } - ] + const [username, password] = Buffer.from(req.get('authorization').split(' ').pop(), 'base64') + .toString('ascii') + .split(':'); + if(process.env.ADMIN_USER === username && process.env.ADMIN_PASS === password) { + return next(); + } + throw { HBErrorCode: '52', code: 401, message: 'Access denied' }; + } }; const junkBrewPipeline = [