Ralphi

This Project is no longer maintained

Ralphi is a simple rate limiting server intended to prevent bruteforce attacks on logins and other sensitive assets. it is very loosely base on limitd but it is much more simple.

Main difference to limitd -

• Memory only. no persistence.
• Simple drip only and frame interval only
• No wait, count or other advance features you can only take or reset a record
• HTTP interface

Ralphi currently has 4 independent npm modules to it

• ralphi - Simple API server for rate limiting, use to store rate limiting data
• ralphi-client - client to easily query the server
• hapi-ralphi - plugin to easily add rate limiting to hapi.js
• express-ralphi - middleware to easily add rate limiting to express.js

Installation

$ npm install -s ralphi
$ npm install -s ralphi-client
# if you wish to use it with hapi install the hapi plugin
$ npm install -s hapi-ralphi

Usage

Start Ralphi server

$ npx ralphi login,5,10m

The above command will start Ralphi with a single login bucket that allows for 5 request every 10 minutes For more information see Ralphi server or run ralphi --help

Integrate rate limiting in hapi.js

const plugin = require('hapi-ralphi');
const client = new require('ralphi-client')();
const server = new require('hapi').Server();

async function init () {
    await server.register({plugin, options: {client}});
    server.route({
        method: 'POST',
        path: '/login',
        config: {
            plugins: {
                ralphi: {
                    bucket: 'login'
                }
            }
        },
        handler () {
            return 'Success';
        }
    });
}
init();

login root will be rate limited according to the bucket settings, and rate limiting headers will be sent with the response.

For more information see hapi-ralphi

Integrate rate limiting in express js

const express   = require('express');
const app       = express();
const RateLimit = require('express-ralphi');
const client    = new require('ralphi-client')();

app.use('/login', RateLimit({bucket: 'login', client}));
app.get('/login', (rec, res) => res.send('Success'));

login root will be rate limited according to the bucket settings, and rate limiting headers will be sent with the response.

For more information see express-ralphi

Integrate rate limiting in other frameworks

const client = new require('ralphi-client')();

async function handler (req, res) { //in your handler code
    const limit = await client.take('login', req.ip);
    if (limit.conformant) {
        //allow access
        return `Request was done. You have ${limit.remaining} more requests until ${new Date(limit.ttl * 1000)}`;
    } else {
        //reject access
        throw new Error(`You have made too many requests. You can send ${limit.size} requests after ${new Date(limit.ttl * 1000)}`);
    }
}

For more information see ralphi-client