Fix Lack of Resources & Rate Limiting in Meteor

Meteor's DDP (Distributed Data Protocol) is inherently vulnerable to resource exhaustion because it doesn't enforce global rate limits by default. An attacker can script a DDP client to spam expensive Meteor methods or subscriptions, pinning the CPU and saturating the Node.js event loop. To secure a Meteor app, you must explicitly implement the DDPRateLimiter to throttle incoming DDP messages based on IP, connection ID, or User ID.

The Vulnerable Pattern

// server/methods.js
Meteor.methods({
  'searchDatabase': function (query) {
    // VULNERABLE: No rate limiting. 
    // An attacker can call this 10,000 times per second.
    return LargeCollection.find({ text: { $regex: query } }).fetch();
  }
});

The Secure Implementation

The vulnerable code allows unrestricted execution of a potentially heavy regex search, leading to Denial of Service (DoS). The secure implementation uses the 'ddp-rate-limiter' package to define a rule for the specific method. By setting a threshold (5 requests per 1000ms), the server will automatically reject excessive calls with a '429 Too Many Requests' error. For production hardening, always apply rules to 'subscription' types as well as 'method' types to prevent Pub/Sub flooding.

// server/methods.js
import { Meteor } from 'meteor/meteor';
import { DDPRateLimiter } from 'meteor/ddp-rate-limiter';
const METHOD_NAME = ‘searchDatabase’;
Meteor.methods({
[METHOD_NAME]: function (query) {
check(query, String);
return LargeCollection.find({ text: { $regex: query } }).fetch();
}
});
if (Meteor.isServer) {
// Define a rule: limit to 5 calls every 1 second per connection
const searchRule = {
type: ‘method’,
name: METHOD_NAME,
connectionId() { return true; }
};
DDPRateLimiter.addRule(searchRule, 5, 1000);
}