AdamPflug / express-brute

Brute-force protection middleware for express routes by rate limiting incoming requests
MIT License
564 stars 90 forks source link

Middleware skipping #57

Closed Martii closed 7 years ago

Martii commented 7 years ago

Hi there. First off I'd like to say that this package has been a site saver for sure and a great big thank you!

On to the nitty gritty.

I've done my best to tailor this to the coding style in the examples here so please forgive me if there's a typo or something I am just plain missing.

We've been utilizing this package like such for about a year with current express v4.x and current LTS nodejs with:

app.route('/test').get(userBruteforce.getMiddleware({ key: someKeyedNewExpressBruteFunction }), doSomethingFunction);

... and it's been working fantastic so far.

What we need to do is something like this:

app.route('/test').get(function (req, res, next) {
  userBruteforce.getMiddleware({ key: someKeyedNewExpressBruteFunction })(req, res, next);
}, doSomethingFunction);

... which seems to work well too... however what we really need is something like this...

app.route('/test').get(function (req, res, next) {
  if (someVar) {
    userBruteforce.getMiddleware({ key: someKeyedNewExpressBruteFunction })(req, res, next);
  } else {
    next(); // or use a different ExpressBrute middleware instance
  }
}, doSomethingFunction);

... when this is done express-brute becomes unstable especially during the first few gets and doesn't seem to behave the same when the someVar conditional doesn't exist.

Some general questions after reading a lot of places on the internet including stackoverflow, the README.md, and testing with the new ExpressBrute.MemoryStore for hours:

Thank you so much for a moment of your time.

Martii commented 7 years ago

Looks like it was both Add-ons in multiple browsers and Extensions in multiple browsers (with native browser implementation)... appears to work in all use cases with the above code without those.

Sorry for the noise. Keep up the great work. :)