Merge pull request #32 from pphatdev/alert-autofix-97

Potential fix for code scanning alert no. 97: Missing rate limiting

Author: pphatdev

src/routes/users.js

@@ -1,11 +1,22 @@
 import { Router } from 'express'
+import rateLimit from 'express-rate-limit'
 import { create, update, get , getOnce } from '../controllers/users.js'
 import { authenticateToken } from '../middlewares/authenticate.js'
 import { Validation } from '../helpers/validator.js'
 import { getData } from '../models/users.js'
 
 export const ROUTE = Router()
 
+// Rate limiter: max 100 requests per 15 minutes per IP
+const usersRateLimiter = rateLimit({
+    windowMs: 15 * 60 * 1000, // 15 minutes
+    max: 100, // limit each IP to 100 requests per windowMs
+    standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
+    legacyHeaders: false, // Disable the `X-RateLimit-*` headers
+})
+
+ROUTE.use(usersRateLimiter)
+
 ROUTE.post("/", async (req, res) => res.send(await create(req.body)) )
 
 ROUTE.use((req, res, next) => authenticateToken(req, res, next))