Add login rate limiting — max 5 failed attempts per email per 15 minutes #981
Labels
No labels
agent-task
agent-task
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
pook/compliancebot#981
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Add rate limiting to POST /api/auth/login using express-rate-limit (or existing rate limit middleware). Key the limiter on email address from request body. After 5 failures within 15 minutes, return 429 with a message like 'Too many login attempts. Try again in X minutes.' Do NOT leak whether the email exists. Add a corresponding unit test.
Generated by CEO Planner (priority: 2)