From 0fbc317e926b5d80363979ee51a4e3c930014efd Mon Sep 17 00:00:00 2001
From: Matt Strapp <matt@mattstrapp.net>
Date: Fri, 11 Feb 2022 00:11:52 -0600
Subject: Do a bunch of random things (still no feature parity) sadge

Signed-off-by: Matt Strapp <matt@mattstrapp.net>
---
 src/index.ts | 56 +++++++++++++++++++++++++++-----------------------------
 1 file changed, 27 insertions(+), 29 deletions(-)

(limited to 'src/index.ts')

diff --git a/src/index.ts b/src/index.ts
index 9e7d082..bd2c7d5 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -1,56 +1,54 @@
 import express, { Request, Response } from 'express';
-import rateLimit from 'express-rate-limit';
-import slowDown from 'express-slow-down';
+
 import path from 'path';
 import { env } from 'process';
 import helmet from 'helmet';
 import csurf from 'csurf';
 import cookieParser from 'cookie-parser';
+import rateLimit from 'express-rate-limit';
+import api from './routes/api';
 
 const app = express();
 
-// Middleware
-const port: string = env.PORT || '2000';
+/* MIDDLEWARE */
 
-app.use(cookieParser());
-const csrf = csurf({ cookie: true });
+// Rate limiting
 const rateLimiter = rateLimit({
     windowMs: 1 * 60 * 1000, // 1 minute
-    max: 30, // Limit each IP to 100 requests per `window` (here, per 15 minutes)
+    max: 40, // Limit each IP to 100 requests per `window` (here, per 15 minutes)
     standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
     legacyHeaders: false, // Disable the `X-RateLimit-*` headers
 });
-const speedLimiter = slowDown({
-    windowMs: 15 * 60 * 1000, // 15 minutes
-    delayAfter: 100, // allow 100 requests per 15 minutes, then...
-    delayMs: 500 // begin adding 500ms of delay per request above 100:
-    // request # 101 is delayed by  500ms
-    // request # 102 is delayed by 1000ms
-    // request # 103 is delayed by 1500ms
-    // etc.
-});
-// This will be run behind an nginx proxy
-app.enable('trust proxy');
-//  apply to all requests
-app.use(speedLimiter);
-app.use('/api', rateLimiter);
+app.use(rateLimiter);
+
+// CSRF protection
+app.use(cookieParser());
+const csrf = csurf({ cookie: true });
+
+
+// Hide the software being used (helps security)
 app.use(helmet());
 
-// Add ejs as view engine
-app.set('view engine', 'ejs');
-app.set('views', path.join(__dirname, 'views/pages'));
-app.use('/public', express.static(path.join(__dirname, 'public')));
+// The API
+app.use('/api', api);
+
+/* RENDERING */
+
+app.set('view engine', 'ejs'); // Add ejs as view engine
+app.set('views', path.join(__dirname, 'views/pages')); // Set views directory (where the ejs lies)
+app.use('/public', express.static(path.join(__dirname, 'public'))); // Set static directory (where the static CSS/JS/images lie)
+
+/* ROUTING */
 
 app.get('/', csrf, (req: Request, res: Response) => {
-    res.render('index', {
-        errors: [],
-    });
+    res.render('index', { csrfToken: req.csrfToken() });
 });
-
 app.get('/about', csrf, (req: Request, res: Response) => {
     res.render('about');
 });
 
+// Start the server
+const port = env.PORT || 2000;
 app.listen(port, () => {
     console.log(`Server is listening on port ${port}`);
 });
\ No newline at end of file
-- 
cgit v1.2.3