Skip to content

feat: add throttling to user invitation and login endpoints #1565

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Artuomka merged 2 commits into from
Feb 5, 2026
Merged

feat: add throttling to user invitation and login endpoints #1565

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7bbbe0a
feat: add throttling to user invitation and login endpoints
Artuomka Feb 5, 2026
9b44ef8
feat: add throttling to password reset request endpoint
Artuomka Feb 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions backend/src/entities/company-info/company-info.controller.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -224,6 +224,7 @@ export class CompanyInfoController {
type: InvitedUserInCompanyAndConnectionGroupDs,
})
@UseGuards(CompanyAdminGuard)
@Throttle({ default: { limit: isTest() ? 200 : 10, ttl: 60000 } })
@Put('user/:companyId')
async inviteUserInCompanyAndConnectionGroup(
@UserId() userId: string,
Expand Down
4 changes: 4 additions & 0 deletions backend/src/entities/user/user.controller.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,8 @@ import { UserSettingsDataRequestDto } from './dto/user-settings-data-request.dto
import { RequestRestUserPasswordDto } from './dto/request-rest-user-password.dto.js';
import { SuccessResponse } from '../../microservices/saas-microservice/data-structures/common-responce.ds.js';
import { Timeout } from '../../decorators/timeout.decorator.js';
import { Throttle } from '@nestjs/throttler';
import { isTest } from '../../helpers/app/is-test.js';

@UseInterceptors(SentryInterceptor)
@Timeout()
Expand Down Expand Up @@ -143,6 +145,7 @@ export class UserController {
description: 'Login successful.',
type: TokenExpDs,
})
@Throttle({ default: { limit: isTest() ? 200 : 5, ttl: 60000 } })

Copilot AI Feb 5, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The OTP login endpoint (/user/otp/login/) performs authentication and issues tokens similar to the regular login endpoint, but it lacks throttling protection. This endpoint should also be throttled to prevent brute-force attacks on 2FA codes. Consider adding a throttle decorator similar to the regular login endpoint.

Copilot uses AI. Check for mistakes.

Copilot AI Feb 5, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The password reset request endpoint (/user/password/reset/request/) can be abused to send spam emails to users. This endpoint should be throttled to prevent abuse. Consider adding a throttle decorator similar to other sensitive endpoints.

Copilot uses AI. Check for mistakes.
@Post('user/login/')
async usualLogin(
@Res({ passthrough: true }) response: Response,
Expand Down Expand Up @@ -294,6 +297,7 @@ export class UserController {
description: 'Password reset requested.',
type: OperationResultMessageDs,
})
@Throttle({ default: { limit: isTest() ? 200 : 5, ttl: 60000 } })
@Post('user/password/reset/request/')
async askResetUserPassword(@Body() emailData: RequestRestUserPasswordDto): Promise<OperationResultMessageDs> {
return await this.requestResetUserPasswordUseCase.execute(emailData, InTransactionEnum.ON);
Expand Down
Loading