Now we also want to install a few packages which are going to be super useful to keep our app secure.
A package called helmet to add security related headers express mongo sanitize to sanitize user supplied
data and express rate limit to limit the amount of requests.
Now the good news is that basically we just need to install the packages, set them up as middleware
and we're pretty much good to go.
So if you want to install in your own project, just go with NPM install and then these are the packages
you want to install.
And in the Readme you can actually find a more detailed description what they're doing and then two
of them will set up in a server.
And then when it comes to rate limiter, technically we can also set it up in a server and as a result
will limit the requests for the entire application.
But in my case we'll just add it to login and the register route.
If you remember, those are the only two public routes we have.
And then rest of requests.
Only the users can make.
So I guess let's just go to a server, grab helmet and mongo sanitize and let's invoke them as middleware.
So let me navigate to a server and I guess right after the cloudinary I'll start with the helmet.
So import.
Helmut.
From.
And that's my package.
And I also want to grab the mongo, sanitize.
And you know what?
Let me actually just double check first.
Yep.
I have installed them already.
So pretty much I'm good to go.
Now I just need to set up a second one.
So, Mongo.
Sanitize.
And the package name is Express Mongo Sanitize.
And essentially, since we're pretty much done with the project, I can remove these two routes.
So one is just Hello world.
And the second one is that test one.
I don't think we'll need them.
I'm pretty much right after the express Json.
We want to invoke both of the packages as middleware.
So I'm just going to go here with helmet and the same deal with the Mongo sanitize.
So essentially, yes, we don't need to do much, install the package, set it up in a server.
So import and then of course invoke it as a middleware.
Now when it comes to rate limiter, we want to navigate to auth routes.
So for starters, let's grab again the package.
In my case, I'm going to go with rate limiter and that is coming from express rate limit.
That's the package name.
And then we want to set up the instance.
Basically we'll provide some options.
In my case, I'll call this API limiter and that is equal to rate limiter.
We want to invoke it and inside of the object first we want to provide time.
So essentially what is going to be the time limit?
We need to provide that in a millisecond.
So again, we do this math where we go with whatever minutes.
In my case, it's going to be 15 times 60.
And then remember one second is 1000 milliseconds.
So we multiply this by 1000.
So this is going to give us one second multiplied by 60.
That's one minute.
And then, of course, whatever value we pick over here is going to be the minute value.
And then we also want to provide how many requests we can make.
And just so I can showcase how everything works, I'm going to go with one.
But please keep in mind that of course normally we'll go with something more reasonable.
And lastly, we want to go with message if there is an error.
And remember, our front end is looking for the object with the message property.
And effectively, if you just provide a string over here, then it's not going to show up nicely in
our toast.
And therefore I'm going to set this one up as an object and I'll go with message.
And again, we're just doing this way since it has been our approach all throughout the application.
And as far as the string value here for the message, I'm just going to go with IP rate limit exceeded.
And then I'm just going to go with try in 15 minutes.
Let's save it.
And now effectively we just need to decide where do we want to implement this rate limiter?
Like I said, I'm going to do it before the register as well as the login one.
So now let me navigate to my login one and let me try to log in with whatever value.
So I'm going to go here with my email and then I'm just going to provide some wrong password.
We click on Submit.
So the first time it's invalid credentials, but then the second time I click notice I have IP rate
limit exceeded and try and 15 minutes.
So essentially I'm not going to be able to make requests for next 15 minutes and we can effectively
see that in the network tab.
Notice the status is not 401, it's actually 429.
And therefore, we know that of course, the response is coming from express rate limit package.
Now, let me set this to something more reasonable.
For example, 15.
And with this in place, we have successfully installed and configured our security packages.