Fix code scanning alert no. 8: Missing rate limiting

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: marcel <[email protected]>

KafkaBridge/lib/authService/index.js

@@ -16,6 +16,7 @@
 'use strict';
 
 const express = require('express');
+const rateLimit = require('express-rate-limit');
 const Authenticate = require('./authenticate');
 const Acl = require('./acl');
 const app = express();
@@ -30,7 +31,12 @@ const init = async function (conf) {
   const config = conf;
   app.use(express.json());
 
-  app.get('/auth', (req, res) => {
+  const authLimiter = rateLimit({
+    windowMs: 15 * 60 * 1000, // 15 minutes
+    max: 100 // limit each IP to 100 requests per windowMs
+  });
+
+  app.get('/auth', authLimiter, (req, res) => {
     auth.authenticate(req, res);
   });
 

KafkaBridge/package.json

@@ -22,7 +22,8 @@
     "openid-client": "^5.1.2",
     "redis": "^4.6.11",
     "underscore": "^1.13.1",
-    "winston": "^3.8.1"
+    "winston": "^3.8.1",
+    "express-rate-limit": "^7.4.1"
   },
   "devDependencies": {
     "chai": "^4.3.6",