Hono Rate Limiting Middleware Codemod
Automatically add rate limiting middleware to Hono.js applications to prevent DoS attacks (CWE-770) and brute force attacks (CWE-307).
Overview
This codemod enhances the security of Hono.js applications by:
- Adding general rate limiting middleware to all routes
- Implementing stricter rate limiting for authentication endpoints
- Protecting against Denial of Service (DoS) attacks
- Preventing brute force authentication attempts
Security Context
Vulnerabilities Addressed:
- CWE-770: Allocation of Resources Without Limits or Throttling
- CWE-307: Improper Restriction of Excessive Authentication Attempts
Without rate limiting, Hono applications are vulnerable to:
- DoS attacks that overwhelm the server with requests
- Brute force attacks on login endpoints
- Resource exhaustion from malicious clients
Installation & Usage
Transformations
Basic Hono App
Before:
After:
Authentication Endpoints
Before:
After:
Detection Scope
The codemod applies to:
- Files importing from the 'hono' package
- TypeScript/JavaScript files with Hono app instantiation
- Files with HTTP method route definitions (
.get(),.post(),.put(),.delete()) - API route files in typical Hono project structures
Exclusions
The codemod will NOT transform:
- Test files (
.test.js,*.spec.ts,__tests__/) - Configuration files (
config.js,settings.ts) - Files already containing rate limiting middleware
- Health check endpoints (
/health,/ping,/status) - Files with explicit disable comments (
@codemod-disable-rate-limiting)
Rate Limiting Configuration
General Routes
- Window: 15 minutes
- Limit: 100 requests per IP
- Headers: Uses draft-6 standard headers
Authentication Routes
Authentication endpoints receive stricter limits:
- Login endpoints (
/login): 5 requests per 15 minutes - API auth routes (
/api/auth/*): 10 requests per 15 minutes - Registration (
/register,/signup): 5 requests per 15 minutes
Dependencies
This codemod adds the following dependency to your project:
You'll need to install it after running the codemod:
Customization
After applying the codemod, you can customize the rate limiting configuration:
Security References
- CWE-770: Allocation of Resources Without Limits or Throttling
- CWE-307: Improper Restriction of Excessive Authentication Attempts
- OWASP API Security - Rate Limiting
- Hono Rate Limiter Documentation
Contributing
- Clone the repository
- Install dependencies:
pnpm install - Run tests:
pnpm test - Make your changes
- Ensure tests pass:
pnpm test - Submit a pull request
Development
License
MIT