From 83976854166a2b7798e0823dedc33d36e839b50f Mon Sep 17 00:00:00 2001 From: Vaibhav Acharya Date: Tue, 26 May 2026 16:50:42 +0530 Subject: [PATCH 1/2] fix: rate limit signup, recover, and verify endpoints --- api/api.go | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/api/api.go b/api/api.go index 91b289279..403b18e5b 100644 --- a/api/api.go +++ b/api/api.go @@ -129,15 +129,30 @@ func NewAPIWithVersion(ctx context.Context, globalConfig *conf.GlobalConfigurati r.With(api.requireAdminCredentials).Post("/invite", api.Invite) - r.With(api.requireEmailProvider).Post("/signup", api.Signup) - r.With(api.requireEmailProvider).Post("/recover", api.Recover) r.With(api.requireEmailProvider).With(api.limitHandler( - // Allow requests at a rate of 30 per 5 minutes. + // Allow up to 10 signup requests per minute per client. + tollbooth.NewLimiter(10.0/60, &limiter.ExpirableOptions{ + DefaultExpirationTTL: time.Hour, + }).SetBurst(10), + )).Post("/signup", api.Signup) + r.With(api.requireEmailProvider).With(api.limitHandler( + // Allow up to 5 password recovery requests per minute per client. + tollbooth.NewLimiter(5.0/60, &limiter.ExpirableOptions{ + DefaultExpirationTTL: time.Hour, + }).SetBurst(5), + )).Post("/recover", api.Recover) + r.With(api.requireEmailProvider).With(api.limitHandler( + // Allow up to 30 token requests per 5 minutes per client. tollbooth.NewLimiter(30.0/(60*5), &limiter.ExpirableOptions{ DefaultExpirationTTL: time.Hour, }).SetBurst(30), )).Post("/token", api.Token) - r.Post("/verify", api.Verify) + r.With(api.limitHandler( + // Allow up to 30 verification attempts per minute per client. + tollbooth.NewLimiter(30.0/60, &limiter.ExpirableOptions{ + DefaultExpirationTTL: time.Hour, + }).SetBurst(30), + )).Post("/verify", api.Verify) r.With(api.requireAuthentication).Post("/logout", api.Logout) From 2ac0150e929e15a79128bbf7335986ead2e79580 Mon Sep 17 00:00:00 2001 From: Vaibhav Acharya Date: Wed, 27 May 2026 13:30:18 +0530 Subject: [PATCH 2/2] chore: empty commit to retrigger CI