How to properly implement chat delay?

Question

JavaScript

Hello. Here I have a chat. I implemented a delay in sending messages on the client side. This is so that the chat does not flood. Used node.js, php, socket. Here is my delay code. But anyone can delete it in the browser console. How to be?

var socket = io.connect( 'http://localhost:8080' );
var socketEmitLastCallTime = 0;
$( "#messageForm" ).submit( function(e) { e.preventDefault();
  var nameVal = $( "#nameInput" ).val();
  var msg = $( "#messageInput" ).val();
  var canalVal = $( "#canalInput" ).val();
    var aqwsde = Date.now() - socketEmitLastCallTime;
  if(aqwsde >= 2 * 1000) {
    socketEmitLastCallTime = Date.now();
    socket.emit( 'message', { name: nameVal, message: msg, canal: canalVal } )
      $( "#messageInput" ).val('');
      // Ajax call for saving datas
    $.ajax({
      url: "./ajax/insertNewMessage.php",
      type: "POST",
      data: { name: nameVal, message: msg, canal: canalVal },
      success: function(data) {
      }
    });
   }else {
   var alert = $('span.alert');
alert.show();
alert.html('Time!!!');
alert.fadeOut(3000);
   //$('span.alert').html('Нельзя отправлять сообщения чаще, чем раз в 2 секунды');
   //alert('Нельзя отправлять сообщение чаще 2 секунд');
   }
});



socket.on( 'message', function( data ) {
  var actualContent = $( "#messages" ).html();
  var newMsgContent = '<li> <strong>' + data.name + '</strong> : ' + data.message
                                          .replace(new RegExp("&#D83DDE04",'gi'),"<img src='../packs/basic/D83DDE04.png' height='21' width='21'>")
                                          .replace(new RegExp("&#D83DDC8A",'gi'),"<img src='../packs/basic/D83DDC8A.png' height='21' width='21'>") + '</li>';
  var content = newMsgContent + actualContent;
  $( "#messages" ).html( content );
});

Answer 1

Only check on the server.
Otherwise, the offended child will be able to write a fludilka script.
It is not quite clear from the code why you are sending data to the node and pulling the php script.
Use one. As a last resort - proxy the data from the node in php, otherwise you may experience desynchronization of states.

Answer 2

Implement a delay on the server, your K.O.

Answer 3

It's easier not to use the delay on the client, but on the server to slow down all requests for the time being. For example, we get the time of the last call and slow down so that the client gets a response at least n seconds after the last one. updates. The main thing is not to overdo it, otherwise the 408 error is guaranteed. The DDOS problem from the browser disappears. they themselves limit the number of connections to one host.