fix(api): add IP rate limiting to track-user endpoint to prevent DoS (JhaSourav07#595)

* fix(svg): sanitize hex colors in monthly badge to prevent XSS

* fix(github): cap max pages in fetchUserRepos to prevent DoS

* fix(api): add IP rate limiting to track-user endpoint to prevent DoS

Author: riddhima25bet10005-a11y

app/api/track-user/route.test.ts

@@ -36,6 +36,7 @@ describe('POST /api/track-user', () => {
     it('returns 400 for malformed JSON request bodies', async () => {
       const malformedRequest = {
         json: vi.fn().mockRejectedValue(new SyntaxError('Unexpected token')),
+        headers: new Headers(),
       } as unknown as Request;
 
       const response = await POST(malformedRequest);

app/api/track-user/route.ts

@@ -1,7 +1,19 @@
 import { NextResponse } from 'next/server';
 import dbConnect from '@/lib/mongodb';
 import { User } from '@/models/User';
+import { trackUserRateLimiter } from '@/lib/rate-limit';
+
 export async function POST(req: Request) {
+  // Get IP for rate limiting
+  const ip = req.headers.get('x-forwarded-for') || req.headers.get('x-real-ip') || 'unknown';
+
+  if (ip !== 'unknown' && !trackUserRateLimiter.check(ip)) {
+    return NextResponse.json(
+      { success: false, error: 'Too many requests, please try again later.' },
+      { status: 429 }
+    );
+  }
+
   let body: unknown;
 
   try {

lib/rate-limit.ts

@@ -0,0 +1,32 @@
+import { TTLCache } from './cache';
+
+// In-memory rate limiter to prevent basic DoS/spam (Denial of Wallet).
+// Note: In a serverless environment, this resets per cold-start/instance,
+// but it is highly effective at stopping aggressive single-instance spikes.
+// For multi-instance strict syncing, a Redis store (Vercel KV/Upstash) should be used.
+export class RateLimiter {
+  private cache: TTLCache<number>;
+  private limit: number;
+  private windowMs: number;
+
+  constructor(limit = 5, windowMs = 60000) {
+    this.limit = limit;
+    this.windowMs = windowMs;
+    // Set max capacity to 10000 IPs to prevent memory leaks from the rate limiter itself
+    this.cache = new TTLCache<number>(10000, windowMs);
+  }
+
+  // Returns true if allowed, false if rate limited
+  check(ip: string): boolean {
+    const current = this.cache.get(ip) || 0;
+    if (current >= this.limit) {
+      return false;
+    }
+    // We increment the count and reset the TTL, behaving similarly to a sliding window timeout.
+    this.cache.set(ip, current + 1, this.windowMs);
+    return true;
+  }
+}
+
+// Global instance for track-user endpoint (5 requests per IP per minute)
+export const trackUserRateLimiter = new RateLimiter(5, 60000);