HIGH: No rate limiting on auth endpoints (login/signup/password-reset)

[Inkcha]

Description

Auth endpoints (login, signup, password reset, resend verification) have zero rate limiting. An attacker can send unlimited requests to these endpoints.

Affected Routes

• POST /api/auth/login
• POST /api/auth/signup
• POST /api/auth/request-password-reset
• POST /api/auth/resend-verification

For comparison, the guess endpoint (POST /api/guess) has rate limiting at 60 req/min per user, but none of the auth routes implement any.

Impact

• Brute force passwords: Unlimited login attempts per IP/account
• Database fill: Mass signup can fill the users table
• Email spam: Repeated password reset requests can spam users' inboxes
• No cost to attacker: No rate limit means no friction

Suggested Fix

Add rateLimit() calls to all auth routes. For example:

if (!rateLimit(`login:${ipHash}`, 5, 60_000).ok) {
  return NextResponse.json({ ok: false, error: "Too many attempts." }, { status: 429 });
}

[Inkcha]

False alarm — all auth routes (login/signup/pw-reset/resend) already have rateLimit() calls. My apologies for the noise.