17 lines
566 B
TypeScript
17 lines
566 B
TypeScript
import { rateLimit, type Context, type Next } from "@wrnexus/core";
|
|
|
|
// Scoped rate limiting: throttle POST /api/login to blunt brute-force attempts.
|
|
// The limiter keeps per-IP counters; other routes pass straight through.
|
|
const loginLimiter = rateLimit({
|
|
max: 5,
|
|
windowMs: 60_000,
|
|
message: "Too many login attempts. Please wait a minute and try again.",
|
|
});
|
|
|
|
export default async function ratelimit(ctx: Context, next: Next) {
|
|
if (ctx.url.pathname === "/api/login" && ctx.req.method === "POST") {
|
|
return loginLimiter(ctx, next);
|
|
}
|
|
return next();
|
|
}
|