Fix limit middleware skip options

[aliereno]

Please provide enough information so that others can review your pull request:
Related: #1567

Explain the details for making this change. What existing problem does the pull request solve?

This solution
1- doesn't forward the request before the limit reached calculations.
2- doesn't returns 429 on successful requests and doesn't overwrite the actual statuscode.

But there is a problem that I can't solve. I need some help.
When remaining number is 1 and next request should be skipped, this code will return 429 because it can't see the actual status code before checking limit reached.

[ReneWerner87]

@aliereno

When remaining number is 1 and next request should be skipped, this code will return 429 because it can't see the actual status code before checking limit reached.

https://github.com/nfriedly/express-rate-limit#skipsuccessfulrequests

you can have a look how other languages do it, this is only a process problem, not a programming language problem.

e.g. in express you should find a solution
https://github.com/nfriedly/express-rate-limit/blob/master/lib/express-rate-limit.js

[aliereno]

@ReneWerner87

I checked the codes. They decreased the hit counter with a callback at the end of response (res.on("finish", ...)). So basically my code does same thing. I think they have same problem. But I didn't test it for express package.
I tried to find different libraries that has feature skip by response's status code. But I couldn't find any.

Also in this express library, they put some info about possible problem of this implementation.

https://github.com/nfriedly/express-rate-limit#skipsuccessfulrequests

# skipSuccessfulRequests
  When set to true successful requests (response status < 400) won't be counted. 
  (Technically they are counted and then un-counted, so a large number of slow 
  requests all at once could still trigger a rate-limit. This may be fixed in a future 
  release.)

I will think about optimal solution. But I can't promise anything.

[ReneWerner87]

I merged the first iteration

[DomiM94]

When will this be released in a new version?

[ReneWerner87]

In the next days.

[meruiden]

Can u guys pls release this a little sooner? this completely breaks the limiter, it simply returns the status code but still executes everything, but we still really need the skip features so rollback is not an option for us.

[ReneWerner87]

I will release the fix right away, just have to wait a short time for the checks