What about IP spoofing? about express-rate-limit HOT 4 CLOSED

Yea, there's a couple of vectors there:

• If the attacker knows a third party's IP, they can use spoofing to make the server deny service to that third party.
• If the attacker doesn't need the servers response to carry out the attack, then IP spoofing will effectively bypass this module.

For something like a login or password reset form, you could mitigate the second attack vector by putting a CSRF token in the form and rate-limiting that.

Old

from express-rate-limit.

Sorry. typing this on a phone...

Old versions of the library had a global: true option, which would basically lock it down for everyone if an attacker hit the site too hard with spoofed IPs, but it wasn't that useful in practice and got removed from v2.

from express-rate-limit.

Aces. Thanks for the quick, helpful reply.

from express-rate-limit.

I apologize, I don't understand the bit about a CSRF token and rate limiting that. What would the attacker be trying to accomplish with a login form if he doesn't need the response? Certainly not logging in/cracking the password since he won't have the response. Also, what value does the CSRF token provide other than its standard use of making sure a user doesn't unintentionally submit a form?

from express-rate-limit.