Rate limiting for sign-in, password reset, and public endpoints #38

New issue

Closed

opened 2026-10-15 01:19:02 -04:00 by vmanne-poc · 0 comments

vmanne-poc commented

2026-10-15 01:19:02 -04:00

Owner

Today: nothing limits repeated requests, except the per-account reset-email throttle. Sign-in can be brute-forced, and the public form submit and tracking endpoints can be flooded.

Plan

Add @nestjs/throttler with a pinned version.
- Strict per-IP limits on POST /auth/login, /auth/register, /auth/forgot-password, /auth/reset-password, and /public/forms/*/submit.
- Looser limits on tracking.
Respect X-Forwarded-For only from a configured trusted proxy (the nginx container).
Return 429 with Retry-After. The web app shows a friendly message.
Optionally, temporarily lock an account after N failed sign-ins (with a notice to the administrator).

Done when

e2e tests show 429 after the limit and that limits reset over time.

**Today:** nothing limits repeated requests, except the per-account reset-email throttle. Sign-in can be brute-forced, and the public form submit and tracking endpoints can be flooded. **Plan** - Add `@nestjs/throttler` with a pinned version. - Strict per-IP limits on `POST /auth/login`, `/auth/register`, `/auth/forgot-password`, `/auth/reset-password`, and `/public/forms/*/submit`. - Looser limits on tracking. - Respect `X-Forwarded-For` only from a configured trusted proxy (the nginx container). - Return 429 with `Retry-After`. The web app shows a friendly message. - Optionally, temporarily lock an account after N failed sign-ins (with a notice to the administrator). **Done when** - e2e tests show 429 after the limit and that limits reset over time.

vmanne-poc added this to the Phase 10: Contacts, senders & sending milestone

2026-10-15 01:19:02 -04:00

vmanne-poc added the

security

label

2026-10-15 01:19:02 -04:00

vmanne-poc referenced this issue from a commit

2026-10-15 08:41:32 -04:00

Rate-limit sign-in, password reset, registration, and form submissions

vmanne-poc referenced this issue from a commit

2026-10-15 08:41:32 -04:00

nginx sets the client address; backend port bound to localhost