picpeak/backend/server-enhanced.js

// This is a partial server.js showing the enhanced rate limiting
// Only the relevant parts are shown - merge with existing server.js

const { createSecureSkipFunction, logRateLimitHit } = require('./src/utils/rateLimitSecurity');

// Enhanced rate limiting with secure skip function
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: process.env.NODE_ENV === 'development' ? 1000 : 100,
  skip: createSecureSkipFunction(), // Use secure skip function
  handler: (req, res) => {
    logRateLimitHit(req, res);
    res.status(429).json({
      error: 'Too many requests from this IP, please try again later.'
    });
  },
  standardHeaders: true, // Return rate limit info in headers
  legacyHeaders: false, // Disable X-RateLimit headers
});

const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5, // limit auth attempts
  skipSuccessfulRequests: true, // Don't count successful logins
  handler: (req, res) => {
    logRateLimitHit(req, res);
    res.status(429).json({
      error: 'Too many login attempts, please try again later.',
      retryAfter: res.getHeader('Retry-After')
    });
  }
});