How to restrict the room create from one IP

[jiabuda]

Hi, I am new here.

I am creating a game use the android device UUID to log into the game without any account mechanism. So the client.create method would be a vulnerable api from the server side. I try to use the npm package express-rate-limit to limit the http request rate, but I found in the source code that, when I use new Server{ server: my server} the framework will delete all the http request listeners and put /matchmaking in first place. So the rate limit function will not work.

How could I limit the http request from one IP in colyseus framework, like 5 second only allow 3 request. Thanks.