[Feature]: Add rate limiting to `/api/auth/login` and `/api/auth/signup` endpoints to prevent brute-force attacks

[prince-pokharna]

Summary

DailyForge's authentication endpoints (/api/auth/login and /api/auth/signup) currently have no rate limiting. An attacker can make unlimited login attempts against any account without restriction. For an app using JWT-based auth with bcrypt password hashing, this is the primary remaining attack surface — and it is entirely unmitigated.

Problem

• No express-rate-limit or equivalent middleware is applied to auth routes
• An attacker can automate unlimited password guesses against any user account
• The signup endpoint is also unprotected, allowing mass account creation (spam/resource abuse)
• The deployed backend at https://dailyforge-backend.onrender.com is publicly accessible

Impact

• User accounts are vulnerable to credential stuffing and brute-force attacks
• The free-tier Render backend can be overwhelmed by automated request floods
• No protection against account enumeration via repeated login attempts

Proposed Solution

Install and configure express-rate-limit:

cd backend
npm install express-rate-limit

Create a reusable rate limiter in backend/middlewares/rateLimiter.js:

import rateLimit from "express-rate-limit";

export const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 10, // Maximum 10 attempts per IP per window
  standardHeaders: true,
  legacyHeaders: false,
  message: {
    error: "Too many attempts from this IP. Please try again after 15 minutes.",
  },
});

export const generalLimiter = rateLimit({
  windowMs: 60 * 1000, // 1 minute
  max: 100,
  standardHeaders: true,
  legacyHeaders: false,
});

Apply in backend/routes/authRoutes.js:

import { authLimiter } from "../middlewares/rateLimiter.js";

router.post("/login", authLimiter, loginUser);
router.post("/signup", authLimiter, registerUser);

This adds a meaningful security layer with minimal code. I will implement and test this end-to-end. Please assign this issue to me.

Labels: security, enhancement, help wanted, GSSoC 2026

[prince-pokharna]

Hey @aryandas2911 ,
Please assign it to me under GSSoC 2026.
/assign /claim /claim-assignment

[aaniya22]

pls assign this to me under gssoc

[sriharshitha128]

/assign

[github-actions]

Hi @sriharshitha128, please wait 6h before claiming this issue again (cooldown active).