Fix Lack of Resources & Rate Limiting in Polka

Polka is a minimalist speed demon, but out of the box, it's a DoS playground. Because it aims for a tiny footprint, it lacks built-in protections against resource exhaustion. Without explicit constraints, an attacker can saturate the event loop or trigger Out-Of-Memory (OOM) errors by flooding endpoints with high-frequency requests or massive payloads. To harden a Polka instance, you must manually integrate middleware to throttle traffic and cap request body sizes.

The Vulnerable Pattern

const polka = require('polka');
const bodyParser = require('body-parser');
// VULNERABLE: No rate limiting and no payload size limits
polka()
.use(bodyParser.json())
.post(‘/api/process’, (req, res) => {
// Complex logic here can be abused to hang the event loop
res.end(‘Data processed’);
})
.listen(3000, err => {
if (err) throw err;
console.log(‘Running on localhost:3000’);
});

The Secure Implementation

The vulnerable code is a classic 'Death by a Thousand Requests' scenario. By omitting limits in 'body-parser', an attacker can send a multi-gigabyte JSON string to crash the process. Furthermore, without rate limiting, a simple loop script can overwhelm the Node.js single-threaded event loop. The secure implementation uses 'express-rate-limit' (which is compatible with Polka's middleware pattern) to enforce a request quota per IP. Crucially, the 'body-parser' configuration now includes a 'limit' property, ensuring the server rejects any payload exceeding 10kb before it can impact memory heap.

const polka = require('polka');
const { json } = require('body-parser');
const rateLimit = require('express-rate-limit');
// Define a strict rate limit
const limiter = rateLimit({
windowMs: 15 * 60 * 1000, // 15 minutes
max: 100, // Limit each IP to 100 requests per window
message: ‘Too many requests, slow down.’,
standardHeaders: true,
legacyHeaders: false,
});
polka()
.use(limiter) // Apply rate limiting globally
.use(json({ limit: ‘10kb’ })) // SECURE: Strict payload limit to prevent OOM
.post(‘/api/process’, (req, res) => {
res.end(‘Securely processed’);
})
.listen(3000, err => {
if (err) throw err;
console.log(‘Hardened Polka running on localhost:3000’);
});