Merge pull request #67 from natron-io/api_throttling

add api call limit per 30s

.github/workflows/codeql-analysis.yml

@@ -14,9 +14,6 @@ name: "CodeQL"
 on:
   push:
     branches: [ main ]
-  pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [ main ]
   schedule:
     - cron: '41 15 * * 5'
 

README.md

@@ -75,6 +75,10 @@ You can send the github code with json body `{"github_code": "..."}` to the `/lo
 ### auth
 `SECRET_KEY` - JWT secret key *optional* (default: random 32 bytes, displayed in the logs)
 
+### api settings
+`CORS` - Define CORS as one string *optional* (default: "*")
+`MAX_REQUESTS` - Define max API requests per 30 Seconds *optional* (default: "100")
+
 ### notifications
 `SLACK_TOKEN` - Tenant API Slack Application User Token *optional* (if not set, the notification REST route will be deactivated) \
 `SLACK_BROADCAST_CHANNEL_ID` - BroadCast Slack Channel ID *optional* (**required** if SLACK_TOKEN is set)

tenant-api.go

@@ -18,9 +18,11 @@ package main
 
 import (
 	"os"
+	"time"
 
 	"github.com/gofiber/fiber/v2"
 	"github.com/gofiber/fiber/v2/middleware/cors"
+	"github.com/gofiber/fiber/v2/middleware/limiter"
 	"github.com/gofiber/template/html"
 	"github.com/natron-io/tenant-api/routes"
 	"github.com/natron-io/tenant-api/util"
@@ -76,6 +78,14 @@ func main() {
 		AllowOrigins:     util.CORS,
 	}))
 
+	app.Use(limiter.New(limiter.Config{
+		Max:        util.MAX_REQUESTS,
+		Expiration: 30 * time.Second,
+		LimitReached: func(c *fiber.Ctx) error {
+			return c.Status(429).SendString("Too many requests")
+		},
+	}))
+
 	app.Static("/styles", "./static/styles")
 	app.Static("/images", "./static/images")
 

util/log.go

@@ -10,6 +10,7 @@ var (
 	InfoLogger    *log.Logger
 	ErrorLogger   *log.Logger
 	Status        string
+	MAX_REQUESTS  int
 )
 
 // InitLoggers initializes the loggers

util/os.go

@@ -44,6 +44,14 @@ func LoadEnv() error {
 		InfoLogger.Printf("CORS set using env: %s", CORS)
 	}
 
+	if MAX_REQUESTS, err = strconv.Atoi(os.Getenv("MAX_REQUESTS")); err != nil {
+		WarningLogger.Println("MAX_REQUESTS is not set")
+		MAX_REQUESTS = 100
+		InfoLogger.Printf("MAX_REQUESTS set using default: %d", MAX_REQUESTS)
+	} else {
+		InfoLogger.Printf("MAX_REQUESTS set using env: %d", MAX_REQUESTS)
+	}
+
 	if SECRET_KEY = os.Getenv("SECRET_KEY"); SECRET_KEY == "" {
 		WarningLogger.Println("SECRET_KEY is not set")
 		// setting random key