Routes has no rate-limiting

[christian-hawk]

HTTP request handlers should not perform expensive operations such as accessing the file system, executing an operating system command or interacting with a database without limiting the rate at which requests are accepted. Otherwise, the application becomes vulnerable to denial-of-service attacks where an attacker can cause the application to crash or become unresponsive by issuing a large number of requests at the same time.

suggestion: express-rate-limit package.

Please check security tab.

[kdhttps]

express-rate-limit is good. we can use it. It limits per IP the number of max request and time
Example:

const limiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100 // limit each IP to 100 requests per windowMs
});

so for max and windowMs values configuration, we have two ways first it to hard code and configurable.
Ofcourse configurable is best option, for that we have to add configuration option in oxTrust Passport > Basic Configuration

@christian-hawk @jgomer2001 let me know what you think about this all?

also if you are agree with this all then are we going to add this feature in Gluu 4.2.x or Gluu 5.0?

[christian-hawk]

Good. It's a security fix for CVE-307, CVE-400 and CVE-770, the context here is a fix rather then a feat.
As we cannot impact on oxTrust right now, we will need to start hardcoding and documenting how to change the values.
So, fix for 4.2

[christian-hawk]

@kdhttps you can talk to @shmorri to submit PR to documentation repo after the code PR merged