[Feature] Rate limiter

[adrien2p]

What
Adding a rate limiter

Why
To avoid malicious DDOS by sending millions of requests
To avoid a bug that send to many requests after each other
To secure a bit more the server

[srindom]

Would this not be best handled by the infrastructure e.g. a load balancer or similar?

[adrien2p]

The load balancer purpose is to route the requests to the available node depending on there charge, if I am not mistaken, it is not to restrict the ip to a certain number of requests per second. But indeed some load balancer can provide that options but it is not there main purpose.

This task is managed at the server level (express here) and you can configure the number of allowed requests in a time frame from the same ip. For example with this kind of middleware

https://www.npmjs.com/package/rate-limiter-flexible

https://www.npmjs.com/package/express-rate-limit

You could also manage that part from NGINX or APACH, but again that is not there strength.

In some cases, you would also want to have some different configuration depending on the worker, and that is managed at its level. For example you want to launch a partial api on one instance, but this api might be more limited than the others for some reason or more open.

In some other cases, most users with simple store does not spin up cluster and load balancing since it is expensive (I've got 72€ bill last month just because it was on and never used it) which means they would still want to secure there server for the single instance they have.

A strategy could be to make it available in medusa through configuration and if the user does not want to use it then it can just not enable it. Wdyt?

I might be wrong though and would be glad to hear your opinion and strategy/conf 😃

[raaghavrm]

Hey
Raaghav here, I wish to contribute to this feature. Could you please assign it to me.
Reference: Aviyel
Thanx @adrien2p

[adrien2p]

Hey @Raaghav4243 very nice that you want to contribute, but i am not sure it has been validated 🤓

[raaghavrm]

Hey, Whats the meaning of Validated ? @adrien2p

[adrien2p]

I mean if it is something that is accepted internally before getting someone to work on it

[gabriel-frattini]

Any updates on this?