feat: Add zones for rate limiting by `ip`, `user`, `session`, `global` #8508

dblythy · 2023-04-14T05:17:48Z

Pull Request

Report security issues confidentially.
Any contribution is under this license.
Link this pull request to an issue.

Issue

Closes: #8507

Approach

Adds zone to rateLimit to allow rate limits:

per user: rate limits per user ID
per session: rate limits per session token
per ip: rate limit per ip (current default)
global: rate limit across all users (useful for DDOS protection for example)

Tasks

Add tests

…sessionToken, userId

parse-github-assistant · 2023-04-14T05:17:50Z

I will reformat the title to use the proper commit message syntax.

parse-github-assistant · 2023-04-14T05:17:53Z

Thanks for opening this pull request!

codecov · 2023-04-14T05:30:06Z

Codecov Report

Patch coverage: 95.23% and project coverage change: -0.02 ⚠️

Comparison is base (967700b) 94.44% compared to head (5410c0b) 94.42%.

❗ Current head 5410c0b differs from pull request most recent head 4f4b747. Consider uploading reports for the commit 4f4b747 to get more accurate results

Additional details and impacted files

@@            Coverage Diff             @@
##            alpha    #8508      +/-   ##
==========================================
- Coverage   94.44%   94.42%   -0.02%     
==========================================
  Files         183      184       +1     
  Lines       14594    14613      +19     
==========================================
+ Hits        13783    13799      +16     
- Misses        811      814       +3

Impacted Files	Coverage Δ
src/Options/Definitions.js	`100.00% <ø> (ø)`
src/Options/index.js	`100.00% <ø> (ø)`
src/middlewares.js	`96.81% <90.00%> (-0.23%)`	⬇️
src/Config.js	`91.27% <100.00%> (+0.10%)`	⬆️
src/ParseServer.js	`97.46% <100.00%> (+0.02%)`	⬆️
src/cloud-code/Parse.Server.js	`100.00% <100.00%> (ø)`

... and 4 files with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

spec/RateLimit.spec.js

dblythy · 2023-05-16T08:07:41Z

Added the ability to define namespaces via Parse.Server, so we can use Parse.Server.RateLimitOptions

mtrezza

Looks good, is this ready for merge?

dblythy · 2023-05-22T05:21:45Z

I have been trying to get enum working with flow / JS Docs (so we can use ParseServerOptions.RateLimitZone.Global) but I haven't been successful - do you have any ideas? I'm thinking it makes more sense than using Parse.Server but I can't get it working

mtrezza · 2023-05-22T14:38:38Z

Hm, what are our options?

dblythy · 2023-06-09T08:22:02Z

I think the current solution is fine. Ready for merge!

# [6.1.0-alpha.20](6.1.0-alpha.19...6.1.0-alpha.20) (2023-06-09) ### Features * Add zones for rate limiting by `ip`, `user`, `session`, `global` ([#8508](#8508)) ([03fba97](03fba97))

parseplatformorg · 2023-06-09T11:29:25Z

🎉 This change has been released in version 6.1.0-alpha.20

# [6.3.0-beta.1](6.2.0...6.3.0-beta.1) (2023-06-10) ### Bug Fixes * Cloud Code Trigger `afterSave` executes even if not set ([#8520](#8520)) ([afd0515](afd0515)) * GridFS file storage doesn't work with certain `enableSchemaHooks` settings ([#8467](#8467)) ([d4cda4b](d4cda4b)) * Inaccurate table total row count for PostgreSQL ([#8511](#8511)) ([0823a02](0823a02)) * LiveQuery server is not shut down properly when `handleShutdown` is called ([#8491](#8491)) ([967700b](967700b)) * Rate limit feature is incompatible with Node 14 ([#8578](#8578)) ([f911f2c](f911f2c)) * Unnecessary log entries by `extendSessionOnUse` ([#8562](#8562)) ([fd6a007](fd6a007)) ### Features * `extendSessionOnUse` to automatically renew Parse Sessions ([#8505](#8505)) ([6f885d3](6f885d3)) * Add new Parse Server option `preventSignupWithUnverifiedEmail` to prevent returning a user without session token on sign-up with unverified email address ([#8451](#8451)) ([82da308](82da308)) * Add option to change the log level of logs emitted by Cloud Functions ([#8530](#8530)) ([2caea31](2caea31)) * Add support for `$eq` query constraint in LiveQuery ([#8614](#8614)) ([656d673](656d673)) * Add zones for rate limiting by `ip`, `user`, `session`, `global` ([#8508](#8508)) ([03fba97](03fba97)) * Allow `Parse.Object` pointers in Cloud Code arguments ([#8490](#8490)) ([28aeda3](28aeda3)) ### Reverts * fix: Inaccurate table total row count for PostgreSQL ([6722110](6722110))

parseplatformorg · 2023-06-10T23:07:18Z

🎉 This change has been released in version 6.3.0-beta.1

# [6.3.0-alpha.1](6.2.0...6.3.0-alpha.1) (2023-06-18) ### Bug Fixes * Cloud Code Trigger `afterSave` executes even if not set ([#8520](#8520)) ([afd0515](afd0515)) * GridFS file storage doesn't work with certain `enableSchemaHooks` settings ([#8467](#8467)) ([d4cda4b](d4cda4b)) * Inaccurate table total row count for PostgreSQL ([#8511](#8511)) ([0823a02](0823a02)) * LiveQuery server is not shut down properly when `handleShutdown` is called ([#8491](#8491)) ([967700b](967700b)) * Rate limit feature is incompatible with Node 14 ([#8578](#8578)) ([f911f2c](f911f2c)) * Unnecessary log entries by `extendSessionOnUse` ([#8562](#8562)) ([fd6a007](fd6a007)) ### Features * `extendSessionOnUse` to automatically renew Parse Sessions ([#8505](#8505)) ([6f885d3](6f885d3)) * Add new Parse Server option `preventSignupWithUnverifiedEmail` to prevent returning a user without session token on sign-up with unverified email address ([#8451](#8451)) ([82da308](82da308)) * Add option to change the log level of logs emitted by Cloud Functions ([#8530](#8530)) ([2caea31](2caea31)) * Add support for `$eq` query constraint in LiveQuery ([#8614](#8614)) ([656d673](656d673)) * Add zones for rate limiting by `ip`, `user`, `session`, `global` ([#8508](#8508)) ([03fba97](03fba97)) * Allow `Parse.Object` pointers in Cloud Code arguments ([#8490](#8490)) ([28aeda3](28aeda3)) ### Reverts * fix: Inaccurate table total row count for PostgreSQL ([6722110](6722110))

parseplatformorg · 2023-06-18T01:23:04Z

🎉 This change has been released in version 6.3.0-alpha.1

# [6.3.0](6.2.2...6.3.0) (2023-09-16) ### Bug Fixes * Cloud Code Trigger `afterSave` executes even if not set ([#8520](#8520)) ([afd0515](afd0515)) * GridFS file storage doesn't work with certain `enableSchemaHooks` settings ([#8467](#8467)) ([d4cda4b](d4cda4b)) * Inaccurate table total row count for PostgreSQL ([#8511](#8511)) ([0823a02](0823a02)) * LiveQuery server is not shut down properly when `handleShutdown` is called ([#8491](#8491)) ([967700b](967700b)) * Rate limit feature is incompatible with Node 14 ([#8578](#8578)) ([f911f2c](f911f2c)) * Unnecessary log entries by `extendSessionOnUse` ([#8562](#8562)) ([fd6a007](fd6a007)) ### Features * `extendSessionOnUse` to automatically renew Parse Sessions ([#8505](#8505)) ([6f885d3](6f885d3)) * Add new Parse Server option `preventSignupWithUnverifiedEmail` to prevent returning a user without session token on sign-up with unverified email address ([#8451](#8451)) ([82da308](82da308)) * Add option to change the log level of logs emitted by Cloud Functions ([#8530](#8530)) ([2caea31](2caea31)) * Add support for `$eq` query constraint in LiveQuery ([#8614](#8614)) ([656d673](656d673)) * Add zones for rate limiting by `ip`, `user`, `session`, `global` ([#8508](#8508)) ([03fba97](03fba97)) * Allow `Parse.Object` pointers in Cloud Code arguments ([#8490](#8490)) ([28aeda3](28aeda3)) ### Reverts * fix: Inaccurate table total row count for PostgreSQL ([6722110](6722110))

parseplatformorg · 2023-09-16T01:11:18Z

🎉 This change has been released in version 6.3.0

feat: create rateLimit zone to rate limit depending on global, ip, …

b217bb3

…sessionToken, userId

parse-github-assistant bot changed the title ~~feat: create rateLimit zone to rate limit depending on global, ip, userId, sessionToken~~ feat: Create rateLimit zone to rate limit depending on global, ip, userId, sessionToken Apr 14, 2023

defintions

acaa31a

dblythy requested a review from a team April 14, 2023 05:31

mtrezza requested changes Apr 14, 2023

View reviewed changes

spec/RateLimit.spec.js Outdated Show resolved Hide resolved

dblythy added 2 commits May 16, 2023 18:05

wip

3413392

Update middlewares.js

5d83644

dblythy added 3 commits May 16, 2023 18:07

Merge branch 'alpha' into rate-limit-zone

969b2fb

tests

63b5174

wip

5a6ba11

mtrezza approved these changes May 17, 2023

View reviewed changes

mtrezza changed the title ~~feat: Create rateLimit zone to rate limit depending on global, ip, userId, sessionToken~~ feat: Create rate limit zone for rate limiting based on global, ip, userId, sessionToken May 17, 2023

mtrezza changed the title ~~feat: Create rate limit zone for rate limiting based on global, ip, userId, sessionToken~~ feat: Create rate limit zone for rate limiting by global, ip, userId, sessionToken May 17, 2023

Merge branch 'alpha' into rate-limit-zone

483e240

Merge branch 'alpha' into rate-limit-zone

4f4b747

mtrezza changed the title ~~feat: Create rate limit zone for rate limiting by global, ip, userId, sessionToken~~ feat: Add zones for rate limiting by ip, user, session, global Jun 9, 2023

mtrezza merged commit 03fba97 into parse-community:alpha Jun 9, 2023

parseplatformorg added the state:released-alpha Released as alpha version label Jun 9, 2023

parseplatformorg added the state:released-beta Released as beta version label Jun 10, 2023

parseplatformorg added the state:released Released as stable version label Sep 16, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Add zones for rate limiting by `ip`, `user`, `session`, `global` #8508

feat: Add zones for rate limiting by `ip`, `user`, `session`, `global` #8508

dblythy commented Apr 14, 2023 •

edited

Loading

parse-github-assistant bot commented Apr 14, 2023

parse-github-assistant bot commented Apr 14, 2023

codecov bot commented Apr 14, 2023 •

edited

Loading

dblythy commented May 16, 2023

mtrezza left a comment

dblythy commented May 22, 2023

mtrezza commented May 22, 2023

dblythy commented Jun 9, 2023

parseplatformorg commented Jun 9, 2023

parseplatformorg commented Jun 10, 2023

parseplatformorg commented Jun 18, 2023

parseplatformorg commented Sep 16, 2023

feat: Add zones for rate limiting by ip, user, session, global #8508

feat: Add zones for rate limiting by ip, user, session, global #8508

Conversation

dblythy commented Apr 14, 2023 • edited Loading

Pull Request

Issue

Approach

Tasks

parse-github-assistant bot commented Apr 14, 2023

parse-github-assistant bot commented Apr 14, 2023

Thanks for opening this pull request!

codecov bot commented Apr 14, 2023 • edited Loading

Codecov Report

dblythy commented May 16, 2023

mtrezza left a comment

Choose a reason for hiding this comment

dblythy commented May 22, 2023

mtrezza commented May 22, 2023

dblythy commented Jun 9, 2023

parseplatformorg commented Jun 9, 2023

parseplatformorg commented Jun 10, 2023

parseplatformorg commented Jun 18, 2023

parseplatformorg commented Sep 16, 2023

feat: Add zones for rate limiting by `ip`, `user`, `session`, `global` #8508

feat: Add zones for rate limiting by `ip`, `user`, `session`, `global` #8508

dblythy commented Apr 14, 2023 •

edited

Loading

codecov bot commented Apr 14, 2023 •

edited

Loading