How to prevent brute force attacks using Node and Express js

Question

I’m working on a Node and Express.js application that requires users to log in, and I want to protect it from brute force attacks. I’ve read about methods like rate limiting and IP-based blocking, but I’m unsure about the best way to implement these techniques in a way that’s both efficient and user-friendly.

What would be the most effective way to prevent brute force login attempts in this type of setup? Any code examples or library recommendations would be very helpful.

Answer 1

To prevent brute-force attacks in a Node and Express.js app, I’ve found a few reliable methods that work well together. Here is what I typically do:

1. One of the simplest and most effective ways to slow down brute-force attacks is by setting up rate limiting. This limits the number of requests a single IP can make within a time frame. express-rate-limit is a solid choice for this.

Installing express-rate-limit is really simple:

npm install express-rate-limit

After installing it. we'll configure it for our login router:

const rateLimit = require('express-rate-limit');

const loginLimiter = rateLimit({
    windowMs: 15 * 60 * 1000,
    max: 5,
    message: "Too many attempts. Please try again later."
});

app.post('/login', loginLimiter, (req, res) => {
})

This stops attackers from blasting your login endpoint with hundreds of requests in seconds.

2. helmet is a great add-on to set secure HTTP headers, which helps protect against other types of attacks.

Installing helmet:

npm install helmet

Adding it to our Application:

const helmet = require('helmet');
app.use(helmet());

3. Sometimes, rate limiting alone isn’t enough. For cases where I’ve noticed persistent attempts from specific IPs, I set up an IP-based blocking mechanism. Here’s an example:

const loginAttempts = {};

app.post('/login', (req, res) => {
    const ip = req.ip;

    if (loginAttempts[ip] && loginAttempts[ip] >= 5) {
        return res.status(429).send("Too many attempts. Try again later.");
    }

    const loginSuccessful = validateLogin(req.body.username, req.body.password);

    if (!loginSuccessful) {
        loginAttempts[ip] = (loginAttempts[ip] || 0) + 1;
        setTimeout(() => delete loginAttempts[ip], 15 * 60 * 1000);
        return res.status(401).send("Invalid credentials.");
    }

    delete loginAttempts[ip];
    res.send("Login successful!");
});

For production environments, consider using a database or Redis to track these attempts more efficiently.

4. I can’t emphasize enough how important it is to hash passwords with bcrypt. It protects users in case your database gets compromised.

const bcrypt = require('bcrypt');
const saltRounds = 10;

const hashedPassword = await bcrypt.hash('userPassword', saltRounds);

5. When a bot doesn’t give up, adding CAPTCHA after a few failed attempts can help. I’ve used Google reCAPTCHA on forms after a certain number of login failures, and it’s effective at stopping bots.

6. If someone’s really determined to brute-force a specific user’s account, an account lockout mechanism can be a lifesaver. After a certain number of failed attempts on an account, lock it temporarily.