Add rate limiting to password reset endpoint #492
Labels
No labels
agent-task
agent-task
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
pook/compliancebot#492
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Issue #468 adds lockout to login but password reset has no brute force protection. Add express-rate-limit at 3 requests per 15 minutes per IP to the password reset request endpoint. Prevents enumeration and abuse. Use same rate-limit library already in the project.
Generated by CEO Planner (priority: 2)