Fix rate limiting middleware

app/routes/api/auth.js

@@ -98,11 +98,11 @@ router.post('/register',
     res.status(200).json({'message': 'Registration successful.'});
 }));
 
+console.log(config.get('RateLimit'));
 const loginLimiter = config.get('RateLimit.enable')
     ? rateLimit({
-        windowMs: config.get('RateLimit.login.window') * 1000,
+        windowMs: 60 * 60 * 1000,//config.get('RateLimit.login.window') * 1000,
-        max: config.get('RateLimit.login.max'),
+        max: 5,//config.get('RateLimit.login.max'),
-        skipSuccessfulRequests: true
     })
     : (req, res, next) => { next(); };
 const loginProps = [
@@ -110,6 +110,7 @@ const loginProps = [
     {name: 'displayname', type: 'string', optional: true},
     {name: 'password', type: 'string'}];
 router.post('/login',
+    loginLimiter,
     bodyVerifier(loginProps),
     canonicalizeRequest,
     wrap(async (req, res, next) => {

app/util/auth.js

@@ -53,32 +53,6 @@ const apiLimiter = config.get('RateLimit.enable')
 // sets req.username, req.displayname, req.scope, and req.key if authenticated properly,
 // otherwise throws an error code.
 // If the user is banned, also throw an error.
-/*
-const requireAuth = scope => wrap(async (req, res, next) => {
-        const status = {
-            authenticated: false,
-            permission: false
-        };
-
-        // First, check the session
-        checkSession(req, scope, status);
-        // If not authenticated yet, check for a key
-        if (!status.authenticated)
-            await checkKey(req, scope, status);
-
-        if (!status.authenticated)
-            return res.status(401).json({message: 'Unauthorized.'});
-        else if (!status.permission)
-            return res.status(403).json({message: 'Forbidden.'});
-
-        // Check if the user is banned
-        const user = await User.findOne({username: req.username});
-        if (user && user.banned)
-            return res.status(403).json({message: 'Forbidden.'});
-
-        next();
-    });
-    */
 const requireAuth = scope => (req, res, next) => {
     apiLimiter(req, res, wrap(async () => {
 

config/default.json

@@ -41,11 +41,11 @@
     "enable": true,
     "login": {
       "window": 600,
-      "max": 5
+      "max": 10
     },
     "register": {
       "window": 600,
-      "max": 5
+      "max": 10
     },
     "api": {
       "window": 600,