added rate-limit

README.md

@@ -81,6 +81,7 @@ Edit the default configuration of the server by adding options to your **laravel
 | `apiOriginAllow`   | `{}`                 | Configuration to allow API be accessed over CORS. [Example](#cross-domain-access-to-api) |
 | `authEndpoint`     | `/broadcasting/auth` | The route that authenticates private channels  |
 | `authHost`         | `http://localhost`   | The host of the server that authenticates private and presence channels  |
+| `maxConcurrentAuthRequests`         | `null`   | Max number of concurrent auth requests, null -> unlimited   |
 | `database`         | `redis`              | Database used to store data that should persist, like presence channel members. Options are currently `redis` and `sqlite` |
 | `databaseConfig`   |  `{}`                | Configurations for the different database drivers [Example](#database) |
 | `devMode`          | `false`              | Adds additional logging for development purposes |
@@ -101,6 +102,7 @@ file, the following options can be overridden:
 - `authHost`: `LARAVEL_ECHO_SERVER_AUTH_HOST` *Note*: This option will fall back to the `LARAVEL_ECHO_SERVER_HOST` option as the default if that is set in the .env file.
 - `host`: `LARAVEL_ECHO_SERVER_HOST`
 - `port`: `LARAVEL_ECHO_SERVER_PORT`
+- `maxConcurrentAuthRequests`: `LARAVEL_ECHO_MAX_CONCURRENT_AUTH_REQUESTS`
 - `devMode`: `LARAVEL_ECHO_SERVER_DEBUG`
 - `databaseConfig.redis.host`: `LARAVEL_ECHO_SERVER_REDIS_HOST`
 - `databaseConfig.redis.port`: `LARAVEL_ECHO_SERVER_REDIS_PORT`

package.json

@@ -22,6 +22,7 @@
     "prepublish": "npm run build"
   },
   "dependencies": {
+    "bottleneck": "^2.19.5",
     "colors": "^1.4.0",
     "dotenv": "^8.2.0",
     "express": "^4.17.1",

src/channels/private-channel.ts

@@ -2,20 +2,29 @@ let request = require('request');
 let url = require('url');
 import { Channel } from './channel';
 import { Log } from './../log';
+let Bottleneck = require('bottleneck');
 
 export class PrivateChannel {
     /**
      * Create a new private channel instance.
      */
     constructor(private options: any) {
         this.request = request;
+        this.limiter = new Bottleneck({
+            maxConcurrent: options.maxConcurrentAuthRequests
+        });
     }
 
     /**
      * Request client.
      */
     private request: any;
 
+    /**
+     * Limiter.
+     */
+    private limiter: any;
+
     /**
      * Send authentication request to application server.
      */
@@ -31,7 +40,7 @@ export class PrivateChannel {
             Log.info(`[${new Date().toISOString()}] - Sending auth request to: ${options.url}\n`);
         }
 
-        return this.serverRequest(socket, options);
+        return this.limiter.schedule(() => this.serverRequest(socket, options));
     }
 
     /**

src/cli/cli.ts

@@ -31,6 +31,7 @@ export class Cli {
         LARAVEL_ECHO_SERVER_DEBUG: "devMode",
         LARAVEL_ECHO_SERVER_HOST: "host",
         LARAVEL_ECHO_SERVER_PORT: "port",
+        LARAVEL_ECHO_MAX_CONCURRENT_AUTH_REQUESTS: "maxConcurrentAuthRequests",
         LARAVEL_ECHO_SERVER_REDIS_HOST: "databaseConfig.redis.host",
         LARAVEL_ECHO_SERVER_REDIS_PORT: "databaseConfig.redis.port",
         LARAVEL_ECHO_SERVER_REDIS_PASSWORD: "databaseConfig.redis.password",

src/echo-server.ts

@@ -17,6 +17,7 @@ export class EchoServer {
     public defaultOptions: any = {
         authHost: 'http://localhost',
         authEndpoint: '/broadcasting/auth',
+        maxConcurrentAuthRequests: null,
         clients: [],
         database: 'redis',
         databaseConfig: {