Fix API Rate Limit Exhaustion in Fresh

// routes/api/data.ts
import { Handlers } from "$fresh/server.ts";
export const handler: Handlers = {
async GET(_req, _ctx) {
// VULNERABILITY: No restriction on how many times this can be called.
// An attacker can script 10k requests/sec to exhaust the upstream API key.
const res = await fetch(“https://api.external-service.com/v1/resource”);
const data = await res.json();
return Response.json(data);
},
};

// routes/_middleware.ts
import { MiddlewareHandlerContext } from "$fresh/server.ts";
const RATELIMIT_WINDOW = 60 * 1000; // 1 minute
const MAX_REQUESTS = 100;
const hits = new Map<string, { count: number; reset: number }>();
export async function handler(req: Request, ctx: MiddlewareHandlerContext) {
if (ctx.destination !== “route”) return await ctx.next();
const ip = ctx.remoteAddr.hostname;
const now = Date.now();
const record = hits.get(ip) || { count: 0, reset: now + RATELIMIT_WINDOW };
if (now > record.reset) {
record.count = 0;
record.reset = now + RATELIMIT_WINDOW;
}
if (record.count >= MAX_REQUESTS) {
return new Response(“Too Many Requests”, {
status: 429,
headers: { “Retry-After”: Math.ceil((record.reset - now) / 1000).toString() }
});
}
record.count++;
hits.set(ip, record);
return await ctx.next();
}