To deter and significantly slow down (but not necessarily prevent) brute force attacks, we can rate limit subsequent requests, slowing down an attacker's access.

The Express Rate Limit middleware is one such option for Node apps, which is already installed in this app.

 Use the basic sample usage code (available via the link to express-rate-limit docs above) to require express-rate-limit and add rate-limiting protection to all routes as the application's first middleware.

For testing purposes, instead of the maximum 100 requests given in the docs, limit the maximum number of requests per IP to just 5 requests every 15 minutes.

 Important: When adding the limiter, make sure that you use the rate limiting middleware after using morgan (

app.use(morgan('combined'))

), which is the package that this app uses for server logs. Otherwise, we will not be able to log in and later see the results of these rate-limited login attempts.

Save your changes and run 

boot

 at the terminal to restart the server.

 Test your default rate-limiting by failing several login attempts. If you use the web app, you will see an error message that says, "Too many requests, please try again later." If you use the script provided in step 1, you will not see an error message in the terminal.

In production, you should use a different data store like Redis to track access by IPs and carefully tune settings to provide adequate security without causing too many false positives that inconvenience real, error-prone users!

In many cases, you may also want to impose significantly different rate limits on different endpoints, such as more aggressively rate-limiting login attempts, forgotten password requests, etc.

• To complete this step:Install and implement the 
• express-rate-limit
•  package with a very low maximum request limit for testing
• Ensure the rate limiting middleware is installed after 'morgan' logging middleware
• Enter the command 
• boot
•  at the terminal to restart the server with your changes
• Make a number of failed login attempts rapidly, resulting in a 
• 429
•  error.