feat: Implement rate limiting, request timeouts, and security headers for improved server protection

2026-10-19 23:15:05 +03:00
parent 7206bf9c4a
commit 85c5baa3e5
8 changed files with 291 additions and 80 deletions
--- a/server/errors.js
+++ b/server/errors.js
@@ -14,6 +14,7 @@
 *   502 source_invalid      the catalog answered, but its folders or tables are not recognised
 *   503 not_ready           /api/ready only: the server is still loading the catalog or its index
 *   504 source_timeout      the university catalog answered too slowly
+ *   504 timeout             the server did not answer within its time limit
 *   500 internal            a fault of the server itself
 */
 export class ApiError extends Error {
--- a/server/index.js
+++ b/server/index.js
@@ -10,6 +10,7 @@ import { apiError, describe } from "./errors.js";
 import { createHash } from "node:crypto";
 import { timetable } from "./timetable.js";
 import { catalogDiagnostics } from "./diagnostics.js";
+import { securityHeaders, requestTimeout } from "./protect.js";
 import {
  getIndex,
  indexStatus,
@@ -35,8 +36,23 @@ app.disable("x-powered-by");
 // Behind Caddy or a tunnel on this host, the client's address comes from X-Forwarded-For;
 // only proxies on private networks are believed, so a client cannot forge its own.
 app.set("trust proxy", "loopback, linklocal, uniquelocal");
+const dist = fileURLToPath(new URL("../dist/", import.meta.url));
+app.use(securityHeaders(dist + "index.html"));
 // gzip or brotli: a semester of lessons is about 200 KB of JSON and shrinks tenfold.
 app.use(compression());
+// A generous limit per address: students behind one dormitory or university NAT share it, so
+// it only stops scrapers and runaway clients. Health checks are not counted.
+app.use(
+  "/api",
+  rateLimit({
+    max: Number(process.env.PSU_API_RATE_LIMIT) || 300,
+    windowMs: 60 * 1000,
+    message: "Слишком много запросов с вашего адреса. Подождите минуту.",
+    skip: (req) => req.path === "/health" || req.path === "/ready",
+  }),
+);
+// Parsing an import may wait for a LibreOffice conversion and other imports.
+app.use("/api", requestTimeout(Number(process.env.PSU_REQUEST_TIMEOUT_MS) || 30_000, { "/import": 90_000 }));
 app.use("/api", (_req, res, next) => {
  // Clients may keep a response but must ask again each time; Express's ETag turns an
  // unchanged answer into an empty 304, so a phone re-downloads a timetable only when it changed.
@@ -49,8 +65,9 @@ app.use("/api", (_req, res, next) => {
 // 5 — error codes (`code` beside `error`, see server/errors.js), timetable 304 before any work;
 // 6 — the timetable carries the group's exams and credits from other catalog documents;
 // 7 — /api/diagnostics, cells the parser could not read with confidence;
-// 8 — /api/ready, and `ready` in /api/health.
-const API_VERSION = 8;
+// 8 — /api/ready, and `ready` in /api/health;
+// 9 — a request limit on /api (429 too_many_requests), a 30 s time limit (504 timeout), security headers.
+const API_VERSION = 9;

 /**
 * What the server still waits for before it answers from memory: the catalog, the week table
@@ -59,10 +76,13 @@ const API_VERSION = 8;
 const waitingFor = (sources, directory) =>
  [!sources.catalog && "catalog", !sources.calendar && "calendar", !directory.builtAt && "index"].filter(Boolean);
 // Liveness plus what the server currently reads from the university, without network calls.
-app.get("/api/health", async (_req, res) => {
+app.get("/api/health", async (req, res) => {
  const sources = await sourceStatus().catch((e) => ({ error: e.message }));
  res.json({
    ok: true,
+    // The caller's address as the server sees it: behind a proxy it must be the client's own,
+    // or every visitor shares one request limit.
+    client: req.ip,
    ready: waitingFor(sources, indexStatus()).length === 0,
    apiVersion: API_VERSION,
    parserVersion: PARSER_VERSION,
@@ -264,7 +284,6 @@ app.post("/api/import", importLimit, upload.single("file"), async (req, res, nex
    next(e.status || e.code === "LIMIT_FILE_SIZE" ? e : apiError(422, "unreadable_file", e.message));
  }
 });
-const dist = fileURLToPath(new URL("../dist/", import.meta.url));
 app.use(express.static(dist, { maxAge: 0 }));
 app.get("/{*path}", (req, res, next) =>
  req.path.startsWith("/api/")
@@ -273,6 +292,8 @@ app.get("/{*path}", (req, res, next) =>
 );
 app.use((error, req, res, _next) => {
  const { status, code, message } = describe(error);
+  // Answered already, by the time limit: the late error is only logged.
+  if (res.headersSent) return console.error(`${req.method} ${req.originalUrl} после ответа: ${error.message}`);
  // Faults of the server keep their stack; expected errors need a line.
  if (status >= 500 && code === "internal") console.error(req.method, req.originalUrl, error);
  else console.error(`${req.method} ${req.originalUrl} → ${status} ${code}: ${error.message}`);
@@ -282,12 +303,17 @@ export { app };

 /** Starts listening and loads the week table and the whole catalog in the background. */
 export function start(port = Number(process.env.PORT || 3001), host = process.env.HOST || "127.0.0.1") {
-  return app.listen(port, host, () => {
+  const server = app.listen(port, host, () => {
    console.log(`API и PWA: http://127.0.0.1:${port}`);
    // So the first visit and the first search do not wait for the university.
    getCalendar().catch((e) => console.error(`Таблица недель: ${e.message}`));
    getIndex().catch((e) => console.error(`Индекс: ${e.message}`));
  });
+  // A client must send its headers within 15 s and the whole request (a Word upload of up to
+  // 10 MB on a slow phone) within two minutes, so slow connections cannot pile up.
+  server.headersTimeout = 15_000;
+  server.requestTimeout = 120_000;
+  return server;
 }
 // `node server/index.js` serves; tests import the app without listening.
 if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1])) start();
--- a/server/limits.js
+++ b/server/limits.js
@@ -5,16 +5,25 @@ import { apiError } from "./errors.js";
 * conversion and seconds of CPU, so one client must not be able to occupy the server.
 */

-/** At most `max` requests per client address in each `windowMs`; the rest get 429. */
-export function rateLimit({ max, windowMs, message }) {
+/**
+ * At most `max` requests per client address in each `windowMs`; the rest get 429.
+ * `skip(req)` exempts a request, such as a health check, from counting.
+ */
+export function rateLimit({ max, windowMs, message, skip = () => false }) {
  const windows = new Map();
+  let swept = 0;
  return (req, res, next) => {
+    if (skip(req)) return next();
    const now = Date.now();
-    // Finished windows are dropped on the way, so the map holds only active clients.
-    for (const [key, w] of windows) if (now - w.start >= windowMs) windows.delete(key);
-    const w = windows.get(req.ip) ?? { start: now, count: 0 };
+    // Finished windows are dropped, at most once a second, so the map holds only active clients
+    // and a crowd of addresses does not make every request walk the whole map.
+    if (now - swept >= 1000) {
+      swept = now;
+      for (const [key, w] of windows) if (now - w.start >= windowMs) windows.delete(key);
+    }
+    let w = windows.get(req.ip);
+    if (!w || now - w.start >= windowMs) windows.set(req.ip, (w = { start: now, count: 0 }));
    w.count++;
-    windows.set(req.ip, w);
    if (w.count <= max) return next();
    res.set("Retry-After", String(Math.ceil((w.start + windowMs - now) / 1000)));
    res.status(429).json({ error: message, code: "too_many_requests" });
--- a/server/protect.js
+++ b/server/protect.js
@@ -0,0 +1,77 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+
+// Protection for a server open to the internet: security headers for the PWA and a time limit
+// for every request. The request rate limit lives in limits.js.
+
+/**
+ * Hashes of the inline scripts in the built index.html (the theme applied before the first
+ * paint), so the Content-Security-Policy allows exactly them and no other inline code.
+ */
+function inlineScriptHashes(indexHtml) {
+  let html = "";
+  try {
+    html = readFileSync(indexHtml, "utf8");
+  } catch {}
+  return [...html.matchAll(/<script(?![^>]*\bsrc=)[^>]*>([\s\S]*?)<\/script>/g)].map(
+    (m) => `'sha256-${createHash("sha256").update(m[1]).digest("base64")}'`,
+  );
+}
+
+/**
+ * Everything the PWA uses comes from this server: scripts, styles, the Roboto Flex font, icons,
+ * the manifest and the service worker. Links to the university's Nextcloud are plain links.
+ */
+export function securityHeaders(indexHtml) {
+  const csp = [
+    "default-src 'self'",
+    `script-src 'self' ${inlineScriptHashes(indexHtml).join(" ")}`.trim(),
+    "style-src 'self'",
+    "img-src 'self' data:",
+    "font-src 'self'",
+    "connect-src 'self'",
+    "manifest-src 'self'",
+    "worker-src 'self'",
+    "object-src 'none'",
+    "base-uri 'none'",
+    "form-action 'self'",
+    "frame-ancestors 'none'",
+  ].join("; ");
+  return (req, res, next) => {
+    res.set({
+      "Content-Security-Policy": csp,
+      "X-Content-Type-Options": "nosniff",
+      "X-Frame-Options": "DENY",
+      "Referrer-Policy": "strict-origin-when-cross-origin",
+      "Cross-Origin-Opener-Policy": "same-origin",
+      "Permissions-Policy": "camera=(), microphone=(), geolocation=(), payment=(), usb=()",
+    });
+    // Only over HTTPS (the proxy says so in X-Forwarded-Proto): browsers ignore it otherwise,
+    // and on a plain http://localhost it would only get in the way.
+    if (req.secure) res.set("Strict-Transport-Security", "max-age=15552000");
+    next();
+  };
+}
+
+/**
+ * A request that has not been answered in `ms` gets 504 `timeout` instead of hanging; whatever
+ * the handler sends later is dropped. Waiting for the university is already capped at 25 s.
+ */
+export function requestTimeout(ms, longer = {}) {
+  return (req, res, next) => {
+    const limit = longer[req.path] || ms;
+    const timer = setTimeout(() => {
+      if (res.headersSent) return;
+      res.set("Retry-After", "30");
+      res.status(504).json({
+        error: "Сервер не успел ответить. Попробуйте ещё раз через минуту.",
+        code: "timeout",
+      });
+    }, limit);
+    timer.unref();
+    const clear = () => clearTimeout(timer);
+    res.on("finish", clear);
+    res.on("close", clear);
+    next();
+  };
+}