redis-backoff

Exponential backoff using redis. Designed specifically for passwords.

Example

var backoff = require('redis-backoff')({
  client: require('then-redis').createClient('tcp://localhost')
});
 
app.use(function* (next) {
  var credentials = yield parse(this);
 
  var username = credentials.username;
 
  // keys to limit against
  var keys = [
    username, // limit by the username
    this.ip, // limit by the ip
  ];
 
  // tell the client it needs to wait
  var retryAfter = yield backoff.check(keys);
  if (retryAFter) {
    this.status = 403;
    this.response.set('Retry-After', Math.ceil(retryAfter / 1000));
    return;
  }
 
  var password = credentials.password;
 
  var user = yield User.getByUsername(username);
  var valid = yield User.checkPassword(user, password);
 
  if (!valid) {
    // give a bad response and push and remember this bad try
    yield backoff.push(keys);
    this.status = 400;
    return;
  }
 
  // if the password is valid, clear the retries
  yield backoff.clear(keys)
  this.status = 200; // log the user in or something
})

API

var backoff = new Backoff(options)

• client - a then-redis client
• backoff - a custom backoff function of the form #retries -> millisecond timeout.

backoff.check(keys).then( retryAfter => )

Checks all the keys whether to backoff. Returns the time to wait in milliseconds.

backoff.push(keys).then( => )

Add a bad try to all the keys. The lock period starts from the current time.

backoff.clear(keys).then( => )

Clear all retries from the keys.