feat: add rate limit for authentication

* improve error handling in frontend

server/src/api/routes/auth.js

@@ -16,11 +16,13 @@ import {
   registerFromSessionValidators,
   registerValidators,
 } from '../validators/authValidator.js'
+import { authenticateRateLimit } from '../../middleware/rateLimiter.js'
 
 const router = Router()
 
 router.post(
   '/login',
+  authenticateRateLimit,
   loginValidators,
   passport.authenticate('local', { failureMessage: true }),
   (req, res) => {
@@ -28,9 +30,9 @@ router.post(
   }
 )
 
-router.post('/register', registerValidators, register)
+router.post('/register', authenticateRateLimit, registerValidators, register)
 
-router.post('/logout', logout)
+router.post('/logout', authenticateRateLimit, logout)
 
 router.get('/check-username', checkUsernameValidators, (req, res) =>
   res.json({ available: true })
@@ -43,16 +45,27 @@ router.get('/available-methods', (req, res) => {
 
 if (enabledMethods.google) {
   router.get('/google', passport.authenticate('google'))
-  router.get('/google/callback', passport.authenticate('google'), socialLogin)
+  router.get(
+    '/google/callback',
+    authenticateRateLimit,
+    passport.authenticate('google'),
+    socialLogin
+  )
 }
 
 if (enabledMethods.github) {
   router.get('/github', passport.authenticate('github'))
-  router.get('/github/callback', passport.authenticate('github'), socialLogin)
+  router.get(
+    '/github/callback',
+    authenticateRateLimit,
+    passport.authenticate('github'),
+    socialLogin
+  )
 }
 
 router.post(
   '/register-from-session',
+  authenticateRateLimit,
   registerFromSessionValidators,
   registerFromSession
 )

server/src/api/routes/sessions.js

@@ -1,6 +1,6 @@
 import { Router } from 'express'
 import * as sessionController from '../controllers/sessionController.js'
-import sessionRateLimit from '../../middleware/sessionRateLimit.js'
+import { sessionRateLimit } from '../../middleware/rateLimiter.js'
 
 const router = Router()
 

server/src/index.js

@@ -12,7 +12,7 @@ import apiRouter from './api/routes/index.js'
 import loadAndUpdateQuests from './utils/quest.js'
 import config from './config.js'
 import errorHandler from './middleware/error.js'
-import globalRateLimit from './middleware/globalRateLimit.js'
+import { globalRateLimit } from './middleware/rateLimiter.js'
 import sessionMiddleware from './middleware/session.js'
 import expiryRemovalScheduler from './containers/expiryChecker.js'
 

server/src/middleware/globalRateLimit.js

@@ -1,6 +0,0 @@
-import { rateLimit } from 'express-rate-limit'
-
-export default rateLimit({
-  windowMs: 60 * 1000, // 1 minute
-  max: 100,
-})

server/src/middleware/rateLimiter.js

@@ -0,0 +1,19 @@
+import rateLimit from 'express-rate-limit'
+
+export const globalRateLimit = rateLimit({
+  windowMs: 60 * 1000, // 1 minute
+  max: 100,
+})
+
+export const authenticateRateLimit = rateLimit({
+  windowMs: 2 * 60 * 1000,
+  max: 5,
+})
+
+export const sessionRateLimit = rateLimit({
+  windowMs: 10 * 1000,
+  max: 1,
+  keyGenerator: (req) => {
+    return req.user ? req.user._id : req.ip
+  },
+})

server/src/middleware/sessionRateLimit.js

@@ -1,9 +0,0 @@
-import { rateLimit } from 'express-rate-limit'
-
-export default rateLimit({
-  windowMs: 10 * 1000,
-  max: 1,
-  keyGenerator: (req) => {
-    return req.user ? req.user._id : req.ip
-  },
-})