MEDIUM: No rate limiting on auth endpoints — vulnerable to brute-force attacks #13

New issue

Closed

opened 2026-05-09 00:03:00 +00:00 by Mark · 1 comment

Mark commented

2026-05-09 00:03:00 +00:00

Owner

Severity: Medium

Location

backend/src/app.ts lines 38–41 (auth route registration)

Description

The /api/auth/login and /api/auth/register endpoints have no rate limiting or brute-force protection. An attacker can send unlimited login attempts.

Impact

Brute-force attacks: Unlimited login attempts allow password guessing
Account enumeration: The 'User already exists' error on register reveals which emails are registered
Resource exhaustion: An attacker could spam the JSON file database with rapid registration requests

Suggested Fix

Add rate limiting middleware:

npm install express-rate-limit

import rateLimit from 'express-rate-limit';

const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 20, // limit each IP to 20 requests per window
  message: { error: 'Too many requests, please try again later' },
});

app.use('/api/auth', authLimiter);

## Severity: Medium ## Location `backend/src/app.ts` lines 38–41 (auth route registration) ## Description The `/api/auth/login` and `/api/auth/register` endpoints have no rate limiting or brute-force protection. An attacker can send unlimited login attempts. ## Impact - **Brute-force attacks**: Unlimited login attempts allow password guessing - **Account enumeration**: The 'User already exists' error on register reveals which emails are registered - **Resource exhaustion**: An attacker could spam the JSON file database with rapid registration requests ## Suggested Fix Add rate limiting middleware: ``` npm install express-rate-limit ``` ```typescript import rateLimit from 'express-rate-limit'; const authLimiter = rateLimit({ windowMs: 15 * 60 * 1000, // 15 minutes max: 20, // limit each IP to 20 requests per window message: { error: 'Too many requests, please try again later' }, }); app.use('/api/auth', authLimiter); ```