feat: add auth rate limiting

Author: ajeaiexecutes

apps/core-api/package.json

@@ -24,6 +24,7 @@
     "cookie-parser": "^1.4.7",
     "dotenv": "^17.2.3",
     "express": "^5.2.1",
+    "express-rate-limit": "^8.5.1",
     "ioredis": "^5.10.1",
     "jsonwebtoken": "^9.0.3",
     "meilisearch": "^0.55.0",

apps/core-api/src/middlewares/rateLimit.middleware.ts

@@ -0,0 +1,15 @@
+import { rateLimit } from 'express-rate-limit';
+
+export const authLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 10, // Limit each IP to 10 requests per windowMs
+  standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
+  legacyHeaders: false, // Disable the `X-RateLimit-*` headers
+  message: {
+    success: false,
+    message: "Too many authentication attempts. Please try again later.",
+  },
+  handler: (req, res, next, options) => {
+    res.status(429).json(options.message);
+  },
+});

apps/core-api/src/routes/auth.routes.ts

@@ -2,17 +2,18 @@ import { Router } from "express";
 
 import { forgotPasswordController, loginController, logoutController, pendingProfileController, refreshTokenController, resendSignupOtpController, resetPasswordController, signupController, verifyResetOtpController, verifySignupOtpController } from "../controllers/auth.controller.js";
 import { authenticate } from "../middlewares/auth.middleware.js";
+import { authLimiter } from "../middlewares/rateLimit.middleware.js";
 
 const router: Router = Router()
-router.post("/login", loginController)
-router.post("/signup", signupController);
+router.post("/login", authLimiter, loginController)
+router.post("/signup", authLimiter, signupController);
 router.post("/refresh", refreshTokenController);
 router.post("/logout", authenticate, logoutController);
-router.post("/verify-signup-otp", verifySignupOtpController);
-router.post("/resend-signup-otp", resendSignupOtpController);
-router.post("/forgot-password", forgotPasswordController);
-router.post("/verify-reset-otp", verifyResetOtpController);
-router.post("/reset-password", resetPasswordController);
+router.post("/verify-signup-otp", authLimiter, verifySignupOtpController);
+router.post("/resend-signup-otp", authLimiter, resendSignupOtpController);
+router.post("/forgot-password", authLimiter, forgotPasswordController);
+router.post("/verify-reset-otp", authLimiter, verifyResetOtpController);
+router.post("/reset-password", authLimiter, resetPasswordController);
 router.post("/pending-profile", pendingProfileController);