Fix runner api rate limit bypass

[github/Chocobozzz/PeerTube.git] / server / middlewares / rate-limiter.ts

diff --git a/server/middlewares/rate-limiter.ts b/server/middlewares/rate-limiter.ts
index 0e936028c2c43f3546d14c3da2201f968317e774..8257965dd35d2c3a449f428bf92bb70e0af6e804 100644 (file)
--- a/server/middlewares/rate-limiter.ts
+++ b/server/middlewares/rate-limiter.ts
@@ -1,5 +1,6 @@
 import express from 'express'
 import RateLimit, { Options as RateLimitHandlerOptions } from 'express-rate-limit'
+import { CONFIG } from '@server/initializers/config'
 import { RunnerModel } from '@server/models/runner/runner'
 import { UserRole } from '@shared/models'
 import { optionalAuthenticate } from './auth'
@@ -39,6 +40,11 @@ export function buildRateLimiter (options: {
   })
 }
 
+export const apiRateLimiter = buildRateLimiter({
+  windowMs: CONFIG.RATES_LIMIT.API.WINDOW_MS,
+  max: CONFIG.RATES_LIMIT.API.MAX
+})
+
 // ---------------------------------------------------------------------------
 // Private
 // ---------------------------------------------------------------------------