nuxt-security breaks the app on Cloudflare Pages

[LilaRest]

Version

nuxt-security: 0.13.0
nuxt: 3.3.3

What is actually happening?

When hosting a Nuxt 3 app on Cloudflare Pages, enabling the nuxt-security module raises a Cannot convert object to primitive value error.

In addition, enabling the module will also break all the server API endpoints that return a non-string value (e.g. an endpoint /api/date that returns a Date object).

Disabling the module or hosting the app on Netlify or Vercel fixes the issue.

Steps to reproduce

• Setup a minimal Nuxt 3 project
• Install and enable nuxt-security
• Build files for Cloudflare Pages using : NITRO_PRESET=cloudflare_pages npx nuxt build
• Download the Cloudflare CLI : npm install -g wrangler
• Run the app locally using : npx wrangler pages dev dist/
• Observe the errors (which are the exact same in production)

[nuxt] [request error] [unhandled] [500] Cannot convert object to primitive value

Other

There is a related discussion on the Cloudflare's repo here : cloudflare/workers-sdk#2081

Thanks !

[Baroshem]

Hey,

thanks for reporting this issue! I will take a look at it in the upcoming days :)

[LilaRest]

Hey,

thanks for reporting this issue! I will take a look at it in the upcoming days :)

@Baroshem Thanks for that :)

[Baroshem]

I am currently investigating this issue but I have a question about the API endpoints. Could you tell me what do you mean that they are breaking?

Like do you get a certain error when running them or something esle breaks?

[LilaRest]

@Baroshem Thanks ! Yeah sure.
I get the exact same error on my own API endpoints : [nuxt] [request error] [unhandled] [500] Cannot convert object to primitive value

By the way I tested again and its seems that any path under /api/ even the one I haven't registered (e.g., /api/notused or just /api/) are returning the same error

[Baroshem]

I suppose it is related to one of my middlewares that are trying to convert the object (maybe a body or query) and it is failing because of different sfructue for Cloudflare, because as you mentioed it works correctly on other hosting providers

[LilaRest]

@Baroshem Yes that makes sense. Have you a precise idea of which middleware could cause that ?

[Baroshem]

I would guess that XSS or Request Size. But I am not sure as I have not worked with Cloudflare that much.

I will check this out tomorrow probably as today I am quite busy with regular work.

If you have some time (and could help me debugging). Could you try to disable some of the middlewares to see which one is causing the problem?

You can do so by just setting a false as a value for certain middleware.

I will really appreciate it :)

[LilaRest]

@Baroshem I'm actually really busy too :|
I'll let you know if I find some time to perform those tests

[shadow81627]

I got an error log that looked like this

[nuxt] [request error] [unhandled] [500] Cannot convert object to primitive value
  at /node_modules/limiter/dist/esm/clock.js:5:43  
  at getMilliseconds (/node_modules/limiter/dist/esm/clock.js:17:1)  
  at new TokenBucket (/node_modules/limiter/dist/esm/TokenBucket.js:46:25)  
  at new RateLimiter (/node_modules/limiter/dist/esm/RateLimiter.js:17:28)  
  at Object.handler (/node_modules/nuxt-security/dist/runtime/server/middleware/rateLimiter.mjs:10:29)  

The error looks to be coming from RateLimiter getMilliseconds https://github.com/jhurliman/node-rate-limiter/blob/main/src/clock.ts#L21-L24

Disabling the rateLimiter middleware helps resolve my error.

[LilaRest]

@shadow81627 Wow thanks for your investigation !
By the way I'm even not sure a local-storage based rate limiter is relevant when the app is hosted on serverless services like Cloudflare Pages. AFAIK, the instances of the app spawned dynamically (to fit the current traffic), don't share nor persist their local storage.

[Baroshem]

Hey @shadow81627 @LilaRest

Thanks for the investigation on that topic.

As this bug seems to be related with external dependency (either rate limiter or memory-cache) I would recommend you to disable this middleware by setting rateLimiter to false in the security conifguration of nuxt.config.ts file.

This also motivates me to create a dicsussion about deprecating the rate limiter functionality as it was supposed to work on the very basic examples and in more advanced cases it seems to be causing more problems than it solves. For real life applications, a seperate solution should be used that could help mitigate cases like DDoS attacks than this in memory rate limiter.

I will create this discussion in the upcoming days.

[Baroshem]

It seems that there is not a lot of traffic on the discussion about removing the rateLimiter so at this point, I can recommend you to disable the rateLimiter. The app should work ok right now. I will add a note in the documentation that this rateLimiter does not work in the Cloudflare Pages.

[Baroshem]

Hey guys,

Could you add some comments in this discussion? #140

I am thinking about derecating the built in rate limiter due to the case that it creates more problems than it solves.