Securing API Endpoints: Rate Limiting & Auth Updates

            nginx
    http {
        # Define a zone for tracking request rates
        # Key by client IP address, allows 100 requests/minute
        limit_req_zone $binary_remote_addr zone=mylimit:10m rate=100r/m;

        server {
            listen 80;
            server_name api.example.com;

            location /api/v1/data {
                # Apply the rate limit to this location
                limit_req zone=mylimit burst=20 nodelay;
                # 'burst' allows for temporary bursts above the rate, 'nodelay' processes them immediately
                # If burst is exceeded, requests are dropped with 503 error.
                proxy_pass http://backend_servers;
            }
        }
    }
        

            javascript
    const rateLimit = require('express-rate-limit');
    const express = require('express');
    const app = express();

    const apiLimiter = rateLimit({
        windowMs: 15 * 60 * 1000, // 15 minutes
        max: 100, // Limit each IP to 100 requests per windowMs
        message: 'Too many requests from this IP, please try again after 15 minutes',
        standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
        legacyHeaders: false, // Disable the `X-RateLimit-*` headers
    });

    // Apply the rate limiting middleware to all requests
    app.use(apiLimiter);

    // Or apply to specific routes
    app.get('/api/secure-data', apiLimiter, (req, res) => {
        res.send('This is your secure data!');
    });

    app.listen(3000, () => console.log('Server running on port 3000'));
        

            const jwt = require('jsonwebtoken');
const SECRET_KEY = process.env.JWT_SECRET || 'your_secret_key'; // Use a strong, env-variable secret!

const authenticateToken = (req, res, next) => {
    const authHeader = req.headers['authorization'];
    const token = authHeader && authHeader.split(' ')[1]; // Bearer TOKEN

    if (token == null) return res.sendStatus(401); // No token, unauthorized

    jwt.verify(token, SECRET_KEY, (err, user) => {
        if (err) {
            console.error('JWT verification error:', err);
            return res.sendStatus(403); // Token invalid or expired
        }
        req.user = user; // Attach user payload to request
        next(); // Proceed to the next middleware/route handler
    });
};

// Example usage:
app.get('/api/profile', authenticateToken, (req, res) => {
    res.json({ message: `Welcome ${req.user.username}!`, data: req.user });
});
        

            const authorizeRoles = (...allowedRoles) => {
    return (req, res, next) => {
        if (!req.user || !req.user.roles) {
            return res.sendStatus(403); // No user or roles in token
        }
        const hasPermission = req.user.roles.some(role => allowedRoles.includes(role));
        if (hasPermission) {
            next();
        } else {
            res.sendStatus(403); // Forbidden
        }
    };
};

// Example usage:
app.post('/api/admin/users', authenticateToken, authorizeRoles('admin'), (req, res) => {
    res.send('Admin-only: User created!');
});

app.get('/api/posts', authenticateToken, authorizeRoles('admin', 'editor', 'viewer'), (req, res) => {
    res.send('View posts for all these roles.');
});