Automated Moderation System (optional)

The Automated Moderation System uses a scoring mechanism to track user violations. As users commit actions like excessive logins, registrations, or messaging, they accumulate violation scores. Upon reaching a set threshold, the user and their IP are temporarily banned. This system ensures platform security by monitoring and penalizing rapid or suspicious activities.

In production, you should have Cloudflare or some other DDoS protection in place to really protect the server from excessive requests, but these changes will largely protect you from the single or several bad actors targeting your deployed instance for proxying.

Notes

• Uses Caching for basic security and violation logging (bans, concurrent messages, exceeding rate limits)
  • In the near future, I will add Redis support for production instances, which can be easily injected into the current caching setup
• Exceeding any of the rate limiters (login/registration/messaging) is considered a violation, default score is 1
• Non-browser origin is a violation
• Default score for each violation is configurable
• Enabling any of the limiters and/or bans enables caching/logging
• Violation logs can be found in the data folder, which is created when logging begins: librechat/data
  • Only violations are logged
  • violations.json keeps track of the total count for each violation per user
  • logs.json records each individual violation per user
• Ban logs are stored in MongoDB under the logs collection. They are transient as they only exist for the ban duration
  • If you would like to remove a ban manually, you would have to remove them from the database manually and restart the server
  • Redis support is also planned for this.

Rate Limiters

The project’s current rate limiters are as follows (see below under setup for default values):

• Login and registration rate limiting
• Optional: Concurrent Message limiting (only X messages at a time per user)
• Optional: Message limiting (how often a user can send a message, configurable by IP and User)
• Optional: File Upload limiting (configurable through librechat.yaml config file)

For further details, refer to the configuration guide provided here: Automated Moderation