<commit_before>module.exports = function( app ) {
  var env = require( "../../config/environment" );
  var url = require("url");

  if ( !env.get( "REDIS_CONNECTION_STRING" ) ) {
    throw new Error("Rate limiting enabled, but no REDIS_CONNECTION_STRING is defined.");
  }

  var redisUrl = url.parse( env.get( "REDIS_CONNECTION_STRING" ) );
  var redisConfig = {
    port: redisUrl.port,
    host: redisUrl.hostname,
    auth: redisUrl.auth,
    db: redisUrl.path.substring( 1 )
  };

  var redisClient = require( "redis" ).createClient( redisConfig.port, redisConfig.host);

  if ( redisConfig.auth ) {
    redisClient.auth( redisConfig.auth );
  }
  if ( redisConfig.db ) {
    redisClient.select( redisConfig.db );
  }

  var limiter = require( "express-limiter" )( app, redisClient );

  // key requests on the client IP and user uid
  var lookupKeys = ["headers.x-forwarded-for", "body.uid"];

  // Due to: https://github.com/ded/express-limiter/issues/3 you have to add 1
  // to the total requests you want to allow. upstream patch filed.

  limiter({
  // Throttle create-account requests to 250 per hour / IP
    path: "/api/v2/user/create",
    method: "post",
    lookup: "headers.x-forwarded-for",
    total: 251,
    expire: 1000 * 60 * 60
  });

  // Throttle OTP login requests to 1 per 10 seconds
  limiter({
    path: "/api/v2/user/request",
    method: "post",
    lookup: lookupKeys,
    total: 2,
    expire: 1000 * 10
  });

  // Throttle token authentication attempts to 10 per 10 seconds
  limiter({
    path: "/api/v2/user/authenticateToken",
    method: "post",
    lookup: lookupKeys,
    total: 11,
    expire: 1000 * 10
  });

  // Throttle password authentication attempts to 10 per 10 seconds
  limiter({
    path: "/api/v2/user/verify-password",
    method: "post",
    lookup: lookupKeys,
    total: 11,
    expire: 1000 * 10
  });

  // Throttle reset requests to one per hour
  limiter({
    path: "/api/v2/user/reset-request-code",
    method: "post",
    lookup: lookupKeys,
    total: 2,
    expire: 1000 * 60 * 60
  });

  // Throttle reset password attempts to 10 per 10 seconds
  limiter({
    path: "/api/v2/user/reset-password",
    method: "post",
    lookup: lookupKeys,
    total: 11,
    expire: 1000 * 10
  });

  // Throttle remove password attempts to 10 per 10 seconds
  limiter({
    path: "/api/v2/user/reset-password",
    method: "post",
    lookup: lookupKeys,
    total: 11,
    expire: 1000 * 10
  });

};<commit_msg>check a custom header for ip to rate limit<commit_after>module.exports = function( app ) {
  var env = require( "../../config/environment" );
  var url = require("url");

  if ( !env.get( "REDIS_CONNECTION_STRING" ) ) {
    throw new Error("Rate limiting enabled, but no REDIS_CONNECTION_STRING is defined.");
  }

  var redisUrl = url.parse( env.get( "REDIS_CONNECTION_STRING" ) );
  var redisConfig = {
    port: redisUrl.port,
    host: redisUrl.hostname,
    auth: redisUrl.auth,
    db: redisUrl.path.substring( 1 )
  };

  var redisClient = require( "redis" ).createClient( redisConfig.port, redisConfig.host);

  if ( redisConfig.auth ) {
    redisClient.auth( redisConfig.auth );
  }
  if ( redisConfig.db ) {
    redisClient.select( redisConfig.db );
  }

  var limiter = require( "express-limiter" )( app, redisClient );

  // key requests on the client IP and user uid
  var lookupKeys = ["headers.x-ratelimit-ip", "body.uid"];

  // Due to: https://github.com/ded/express-limiter/issues/3 you have to add 1
  // to the total requests you want to allow. upstream patch filed.

  limiter({
  // Throttle create-account requests to 250 per hour / IP
    path: "/api/v2/user/create",
    method: "post",
    lookup: "headers.x-ratelimit-ip",
    total: 251,
    expire: 1000 * 60 * 60
  });

  // Throttle OTP login requests to 1 per 10 seconds
  limiter({
    path: "/api/v2/user/request",
    method: "post",
    lookup: lookupKeys,
    total: 2,
    expire: 1000 * 10
  });

  // Throttle token authentication attempts to 10 per 10 seconds
  limiter({
    path: "/api/v2/user/authenticateToken",
    method: "post",
    lookup: lookupKeys,
    total: 11,
    expire: 1000 * 10
  });

  // Throttle password authentication attempts to 10 per 10 seconds
  limiter({
    path: "/api/v2/user/verify-password",
    method: "post",
    lookup: lookupKeys,
    total: 11,
    expire: 1000 * 10
  });

  // Throttle reset requests to one per hour
  limiter({
    path: "/api/v2/user/request-reset-code",
    method: "post",
    lookup: lookupKeys,
    total: 2,
    expire: 1000 * 60 * 60
  });

  // Throttle reset password attempts to 10 per 10 seconds
  limiter({
    path: "/api/v2/user/reset-password",
    method: "post",
    lookup: lookupKeys,
    total: 11,
    expire: 1000 * 10
  });
};
{'fraction_non_alphanumeric': 0.13528795811518324, 'fraction_numerical': 0.03539267015706806, 'mean_word_length': 2.784469096671949, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6050425', 'n_tokens_mistral': 1779, 'n_tokens_neox': 1608, 'n_words': 463}