How to setup rate limit for /api/

dhb · June 23, 2022, 5:21am

The rate limit policy has now been changed to a middleware.

The ratelimit.js can now be found here:

strapi/strapi/blob/master/packages/plugins/users-permissions/server/middlewares/rateLimit.js

'use strict';

module.exports = (config, { strapi }) => async (ctx, next) => {
  const ratelimit = require('koa2-ratelimit').RateLimit;

  const message = [
    {
      messages: [
        {
          id: 'Auth.form.error.ratelimit',
          message: 'Too many attempts, please try again in a minute.',
        },
      ],
    },
  ];

  return ratelimit.middleware(
    Object.assign(
      {},
      {

This file has been truncated. show original

See the example of ratelimit middleware usage from a plugin extension below:

    plugin.routes['content-api'].routes.push({
        method: 'GET',
        path: '/auth/passwordless',
        handler: 'auth.passwordless',
        config: {
            // policies: ['plugins::users-permissions.ratelimit'], (deprecated) 
            middlewares: ['plugin::users-permissions.rateLimit'],
            prefix: '',
        },
    })