Feature: Implement rate limiting on auth endpoints #7

New issue

Closed

opened 2026-03-10 03:46:13 +00:00 by Mark · 0 comments

Mark commented

2026-03-10 03:46:13 +00:00

Owner

Issue

Authentication endpoints (/auth/login, /auth/register) have no rate limiting, vulnerable to brute force attacks.

Location

services/api/app/routes/auth.py:33,79

Current Implementation

No rate limiting middleware or endpoint-level protection.

Risk

Brute force password attacks
User enumeration attacks
Registration spam

Proposed Solution

Implement rate limiting using:

slowapi library (FastAPI compatible)
Redis-based rate limiting for distributed deployments
Per-IP and per-account limits

Example:

from slowapi import Limiter
from slowapi.util import get_remote_address

limiter = Limiter(key_func=get_remote_address)

@router.post("/login")
@limiter.limit("5/minute")
def login(...)

Acceptance Criteria

Add rate limiting dependency
Implement on /auth/login (5/min per IP)
Implement on /auth/register (3/hour per IP)
Add rate limit headers to responses
Document rate limits in API docs

Priority: Medium
Type: Security/Feature

## Issue Authentication endpoints (`/auth/login`, `/auth/register`) have no rate limiting, vulnerable to brute force attacks. ## Location - `services/api/app/routes/auth.py:33,79` ## Current Implementation No rate limiting middleware or endpoint-level protection. ## Risk - Brute force password attacks - User enumeration attacks - Registration spam ## Proposed Solution Implement rate limiting using: 1. `slowapi` library (FastAPI compatible) 2. Redis-based rate limiting for distributed deployments 3. Per-IP and per-account limits Example: ```python from slowapi import Limiter from slowapi.util import get_remote_address limiter = Limiter(key_func=get_remote_address) @router.post("/login") @limiter.limit("5/minute") def login(...) ``` ## Acceptance Criteria - [ ] Add rate limiting dependency - [ ] Implement on /auth/login (5/min per IP) - [ ] Implement on /auth/register (3/hour per IP) - [ ] Add rate limit headers to responses - [ ] Document rate limits in API docs **Priority:** Medium **Type:** Security/Feature