secure-express-setup/lib/bruteForce.js

Military-grade one-command security setup for Express.js applications

const rateLimit = require("express-rate-limit");

/**
 * Setup brute force protection middleware
 * @param {Object} options - Brute force protection options
 * @param {String} redisUrl - Optional Redis URL
 */
function setupBruteForce(options = {}, redisUrl) {
  const config = {
    windowMs: options.windowMs || 15 * 60 * 1000, // 15 minutes
    max: options.maxAttempts || options.max || 10, // 10 failed attempts
    message: options.message || {
      error: "Too many failed attempts",
      message: "Account temporarily locked. Please try again later."
    },
    skipSuccessfulRequests: true, // Only count failed attempts
    skip: (req, res) => {
      // Skip for certain paths or conditions
      return false;
    }
  };

  // Note: Removed Redis store for simplicity
  // In production, you'd want Redis for distributed brute force protection
  
  return rateLimit(config);
}

module.exports = setupBruteForce;