Fix Lack of Resources & Rate Limiting in LoopBack

// src/controllers/auth.controller.ts
import {post, requestBody} from '@loopback/rest';
export class AuthController {
@post(‘/login’)
async login(@requestBody() credentials: any): Promise {
// VULNERABILITY: No throttling. An attacker can fire 10,000 requests/sec
// to brute-force passwords or exhaust DB connection pools.
return this.authService.verify(credentials);
}
}

// 1. Install: npm install loopback4-ratelimiter
// 2. src/sequence.ts
import {inject} from '@loopback/context';
import {FindRoute, InvokeMethod, ParseParams, Reject, RequestContext, RestBindings, SequenceHandler} from '@loopback/rest';
import {RateLimitAction, RateLimitSecurityBindings} from 'loopback4-ratelimiter';
export class MySequence implements SequenceHandler {
constructor(
@inject(RestBindings.SequenceActions.FIND_ROUTE) protected findRoute: FindRoute,
@inject(RestBindings.SequenceActions.PARSE_PARAMS) protected parseParams: ParseParams,
@inject(RestBindings.SequenceActions.INVOKE_METHOD) protected invoke: InvokeMethod,
@inject(RestBindings.SequenceActions.REJECT) public reject: Reject,
@inject(RateLimitSecurityBindings.RATELIMIT_ACTION) protected rateLimitAction: RateLimitAction,
) {}
async handle(context: RequestContext) {
try {
const {request, response} = context;
const route = this.findRoute(request);
// SECURE: Intercepting the request before execution
await this.rateLimitAction(request, response);
const args = await this.parseParams(request, route);
const result = await this.invoke(route, args);
this.send(response, result);
} catch (err) {
this.reject(context, err);
}
}
}