From e59c716e19d17b40963c2a291e9a52a3904c70b1 Mon Sep 17 00:00:00 2001 From: shravya290706 Date: Tue, 2 Jun 2026 21:54:55 +0530 Subject: [PATCH 1/2] fix: apply authLimiter to OTP and password reset routes --- apps/dashboard-api/src/routes/auth.js | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/apps/dashboard-api/src/routes/auth.js b/apps/dashboard-api/src/routes/auth.js index 3ef3aa512..c4897a439 100644 --- a/apps/dashboard-api/src/routes/auth.js +++ b/apps/dashboard-api/src/routes/auth.js @@ -40,11 +40,11 @@ router.put('/change-password', authorization, changePassword); router.delete('/delete-account', authorization, deleteAccount); -router.post('/send-otp', sendOtp); -router.post('/verify-otp', verifyOtp); +router.post('/send-otp', authLimiter, sendOtp); +router.post('/verify-otp', authLimiter, verifyOtp); -router.post('/forgot-password', forgotPassword); -router.post('/reset-password', resetPassword); +router.post('/forgot-password', authLimiter, forgotPassword); +router.post('/reset-password', authLimiter, resetPassword); router.post('/refresh-token', refreshToken); router.post('/logout', authorization, logout); From 7a10958bd710534a8e5c8200fd6d60be7a44e9f5 Mon Sep 17 00:00:00 2001 From: shravya290706 Date: Tue, 2 Jun 2026 22:09:13 +0530 Subject: [PATCH 2/2] refactor: isolate auth routes from dashboard limiter --- apps/dashboard-api/src/routes/auth.js | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/apps/dashboard-api/src/routes/auth.js b/apps/dashboard-api/src/routes/auth.js index c4897a439..fa4273826 100644 --- a/apps/dashboard-api/src/routes/auth.js +++ b/apps/dashboard-api/src/routes/auth.js @@ -31,6 +31,13 @@ const dashboardLimiter = rateLimit({ router.post('/register', authLimiter, register); router.post('/login', authLimiter, login); + +router.post('/send-otp', authLimiter, sendOtp); +router.post('/verify-otp', authLimiter, verifyOtp); + +router.post('/forgot-password', authLimiter, forgotPassword); +router.post('/reset-password', authLimiter, resetPassword); + router.get('/github/start', startGithubAuth); router.get('/github/callback', handleGithubCallback); @@ -40,12 +47,6 @@ router.put('/change-password', authorization, changePassword); router.delete('/delete-account', authorization, deleteAccount); -router.post('/send-otp', authLimiter, sendOtp); -router.post('/verify-otp', authLimiter, verifyOtp); - -router.post('/forgot-password', authLimiter, forgotPassword); -router.post('/reset-password', authLimiter, resetPassword); - router.post('/refresh-token', refreshToken); router.post('/logout', authorization, logout);