fix(auth): add per-email rate limiting to resend-otp endpoint#29
Open
algojogacor wants to merge 1 commit into
Open
fix(auth): add per-email rate limiting to resend-otp endpoint#29algojogacor wants to merge 1 commit into
algojogacor wants to merge 1 commit into
Conversation
Prevent OTP email abuse by enforcing a 60-second cooldown between resend requests tracked per user via the lastOtpResentAt field. Previously, the endpoint only used IP-based rate limiting via express-rate-limit, which can be bypassed by rotating IP addresses. This adds a database-level cooldown that prevents the same email from triggering unlimited OTP emails regardless of source IP. Changes: - Add lastOtpResentAt field to User model (select: false) - Enforce 60s cooldown in resendOtpService before issuing new OTP - Return descriptive error with retry-after seconds on cooldown hit - Use existing AUTH_TOO_MANY_ATTEMPTS error code for consistency Closes voiceyBill#26
|
@algojogacor is attempting to deploy a commit to the voiceyBill's projects Team on Vercel. A member of the Team first needs to authorize it. |
Owner
|
@algojogacor Please make sure all workflow runs/checks are passing. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #26 —
POST /auth/resend-otphad no effective rate limiting, allowing unlimited OTP emails to be triggered for any email address.Problem
The endpoint was protected only by
express-rate-limit(IP-based), which can be trivially bypassed by rotating IP addresses or using proxies. An attacker could loop-call the endpoint and:Solution
Added per-email cooldown tracking at the database level:
lastOtpResentAt: Datefield (not selected by default)Key design decisions
AUTH_TOO_MANY_ATTEMPTSerror code — consistent with the project's error conventionsexpress-rate-limitmiddleware remains — defense in depthChanges
src/models/user.model.tslastOtpResentAtfield to UserDocument interface and schemasrc/services/auth.service.tslastOtpResentAton successful resendTesting
Screenshots
N/A — backend-only change.