[Security] No Rate Limiting on /api/auth/login and /api/auth/signup — Brute-Force Attack Vector

[advikdivekar]

Description

A CRITICAL security vulnerability exists in backend/routes/auth.js at lines 9 and 34. There is no rate limiting, account lockout, or any throttling mechanism on the login or signup endpoints, allowing unlimited automated credential-stuffing and brute-force attacks.

Impact

An attacker can automate millions of password attempts against any known email address with no server-side resistance. Using a common wordlist (e.g., rockyou.txt), a weak password can be cracked in minutes. The signup endpoint is similarly unprotected, enabling bot-driven mass account registration that can exhaust database capacity.

Steps to Reproduce

1. Send POST /api/auth/login with { "email": "victim@example.com", "password": "wrong" } in a loop 100 times.
2. Observe all 100 requests return 401 — none are blocked or slowed.
3. Replace "wrong" with a password from a dictionary list and observe successful login on a weak account.

Expected Behaviour

After 10 failed attempts from the same IP within 15 minutes, the server should return 429 Too Many Requests with a Retry-After header.

Proposed Fix

Install express-rate-limit and apply a limiter of 10 requests per 15-minute window per IP to /api/auth/login and /api/auth/signup, configured with skipSuccessfulRequests: true.

// backend/server.js
const rateLimit = require('express-rate-limit');

const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 10,
  standardHeaders: true,
  legacyHeaders: false,
  message: { message: 'Too many attempts, please try again after 15 minutes.' },
  skipSuccessfulRequests: true,
});

app.use('/api/auth/login', authLimiter);
app.use('/api/auth/signup', authLimiter);

Files affected: backend/routes/auth.js, backend/server.js, backend/package.json

Labels

type:security level:intermediate gssoc:approved

Please assign this issue to me under GSSoC 2026. I will open a PR with a complete fix covering all affected files, proper test coverage, and verification steps.