Version 2.0 Roadmap

Just thought I’d provide some context on the things I hoping to accomplish for a version 2 of express-brute, which I’d like to get out for beta in June:

Major Changes

• New storage adapter layer
  • Should allow for atomic updates to storage to resolve #46
  • Ideally should generalize the storage adapter layer so that it can be used by other projects as well (not tied directly to express-brute).
  • This will unfortunately require the existing express-brute storage adapters to be updated or replaced, I’m still on the fence on whether it makes sense to create a small “migration” adapter that allows existing storage adapters to be used (without fixing the vulnerability described in #46 fixed) until suitable replacements/updates can be developed. May be better to protect people from themselves there.
• Separate out the core code from the code that interacts with express.
  • This enables me to develop a koa version as well (which would be nice because I rarely use express for new projects at this point)
  • This should also let people use the underlying rate-limiting functionality in more customized ways if they need to (#28, #22)

Minor Improvements

• Optimize hash calculation and allow it to be bypassed/overwritten (#70)
• Add the option to attach the number of remaining requests to the request object (#73)
• Look at standardizing the options between the constructor and getMiddleware() (#64, #20)

[AdamPflug]

@AnandChowdhary I ran into some unexpected delays because of offline stuff, but I’m actively working on this now and targeting a beta release next week.

[AdamPflug]

@animir I’ve been considering it, but I have a few reservations:

1. rate-limiter-flexible doesn’t have a pluggable backend architecture, so it requires updates to the core to add new store options (e.g. amazon dynamodb).
2. rate-limiter-flexible doesn’t work with sliding timeout windows and requires you to jump through some hoops with multiple gets/sets per request to do exponential backoffs.
3. I’ve got a bit of a bad taste in my mouth from my previous interactions with you around this project. One the bright side it’s clear you’re dedicated to making your project the best that you can.

I haven’t made a final decision either way yet though (but it does look like work on this may continue out another week).