Skip to content

fix: rate limit signup, recover, and verify endpoints #450

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
VaibhavAcharya merged 5 commits into from
May 28, 2026
Merged

fix: rate limit signup, recover, and verify endpoints #450

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8397685
fix: rate limit signup, recover, and verify endpoints
VaibhavAcharya May 26, 2026
25681de
Merge branch 'master' into vaibhavacharya/ex-1858-identity-no-rate-li…
VaibhavAcharya May 26, 2026
2ac0150
chore: empty commit to retrigger CI
VaibhavAcharya May 27, 2026
c5ad977
Merge branch 'master' into vaibhavacharya/ex-1858-identity-no-rate-li…
VaibhavAcharya May 27, 2026
85c9ad7
Merge branch 'master' into vaibhavacharya/ex-1858-identity-no-rate-li…
VaibhavAcharya May 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 19 additions & 4 deletions api/api.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,15 +133,30 @@ func NewAPIWithVersion(ctx context.Context, globalConfig *conf.GlobalConfigurati

r.With(api.requireAdminCredentials).Post("/invite", api.Invite)

r.With(api.requireEmailProvider).Post("/signup", api.Signup)
r.With(api.requireEmailProvider).Post("/recover", api.Recover)
r.With(api.requireEmailProvider).With(api.limitHandler(
// Allow requests at a rate of 30 per 5 minutes.
// Allow up to 10 signup requests per minute per client.
tollbooth.NewLimiter(10.0/60, &limiter.ExpirableOptions{
DefaultExpirationTTL: time.Hour,
}).SetBurst(10),
)).Post("/signup", api.Signup)
r.With(api.requireEmailProvider).With(api.limitHandler(
// Allow up to 5 password recovery requests per minute per client.
tollbooth.NewLimiter(5.0/60, &limiter.ExpirableOptions{
DefaultExpirationTTL: time.Hour,
}).SetBurst(5),
)).Post("/recover", api.Recover)
r.With(api.requireEmailProvider).With(api.limitHandler(
// Allow up to 30 token requests per 5 minutes per client.
tollbooth.NewLimiter(30.0/(60*5), &limiter.ExpirableOptions{
DefaultExpirationTTL: time.Hour,
}).SetBurst(30),
)).Post("/token", api.Token)
r.Post("/verify", api.Verify)
r.With(api.limitHandler(
// Allow up to 30 verification attempts per minute per client.
tollbooth.NewLimiter(30.0/60, &limiter.ExpirableOptions{
DefaultExpirationTTL: time.Hour,
}).SetBurst(30),
)).Post("/verify", api.Verify)

r.With(api.requireAuthentication).Post("/logout", api.Logout)

Expand Down
Loading