Implement Brute-Force Protection for Login Endpoints

const express = require('express');
const rateLimit = require('express-rate-limit');

const app = express();
app.use(express.json()); // For parsing application/json

// Rate limit configuration for login attempts
const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 5, // Limit each IP to 5 login requests per `windowMs`
  message: 'Too many login attempts from this IP, please try again after 15 minutes',
  handler: (req, res, next, options) => {
    res.status(options.statusCode).send(options.message);
  },
  standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
  legacyHeaders: false, // Disable the `X-RateLimit-*` headers
});

// Apply the rate limiter to specific routes
app.post('/api/login', loginLimiter, (req, res) => {
  const { username, password } = req.body;
  // In a real application, you would validate credentials here
  if (username === 'user' && password === 'password') {
    res.status(200).json({ message: 'Login successful' });
  } else {
    // Note: Always return a generic error message for failed login attempts
    // to avoid leaking information about valid usernames.
    res.status(401).json({ message: 'Invalid credentials' });
  }
});

// Other routes can be unprotected or have different limits
app.get('/api/public', (req, res) => {
  res.send('Public content');
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});