feat(security): add Redis login rate limiting

[bhavyajain0810]

Pull Request

Description

This PR adds Redis-backed rate limiting to the password-based login endpoint to protect it against brute-force and credential-stuffing attacks across distributed backend instances.

The implementation applies two independent limits:

• per-client-IP login attempts;
• per-account login attempts across multiple client IP addresses.

Account identifiers are normalized and SHA-256 hashed before being included in Redis keys, preventing plaintext email addresses from appearing in Redis key names.

Additional security and reliability improvements include:

• atomic counter and expiry updates using a Redis Lua script;
• configurable rate-limit capacities and time windows;
• HTTP 429 Too Many Requests responses;
• Retry-After, X-RateLimit-Limit, and X-RateLimit-Remaining headers;
• fail-open handling when Redis is unavailable;
• optional forwarding-header support, disabled by default to prevent spoofed client IP headers;
• service and controller tests for the new behaviour.

Closes #838

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

Configuration

security.rate-limit.auth.login.enabled=${LOGIN_RATE_LIMIT_ENABLED:true}
security.rate-limit.auth.login.ip.max-attempts=${LOGIN_RATE_LIMIT_IP_MAX_ATTEMPTS:5}
security.rate-limit.auth.login.ip.window-seconds=${LOGIN_RATE_LIMIT_IP_WINDOW_SECONDS:60}
security.rate-limit.auth.login.account.max-attempts=${LOGIN_RATE_LIMIT_ACCOUNT_MAX_ATTEMPTS:10}
security.rate-limit.auth.login.account.window-seconds=${LOGIN_RATE_LIMIT_ACCOUNT_WINDOW_SECONDS:900}
security.rate-limit.auth.login.key-prefix=${LOGIN_RATE_LIMIT_KEY_PREFIX:rate-limit:auth:login}
security.rate-limit.auth.login.trust-forwarded-headers=${LOGIN_RATE_LIMIT_TRUST_FORWARDED_HEADERS:false}

Tests added

Test coverage was added for:

• allowing requests within both limits;
• blocking requests that exceed the per-IP limit;
• blocking account-level attacks across different IP addresses;
• case-insensitive email normalization;
• SHA-256-hashed account Redis keys;
• incomplete Redis script responses;
• Redis connection failures;
• disabled rate limiting;
• HTTP 429 status and response headers;
• trusted forwarding-header handling;
• preventing authentication and repository calls after a request is blocked.

Validation note

mvn -DskipTests compile reaches compilation of the project sources but is blocked by a pre-existing issue on the clean upstream branch.

The project references missing com.networknt.schema classes in:

• GroqResponseValidator;
• VakilFriendGroqValidatorService.

No compiler errors were reported for RedisRateLimitService or AuthController, which are the production files changed by this PR.

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation/configuration
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

The final checkbox remains unchecked because the existing upstream compilation failure prevents the Maven test lifecycle from running successfully. The failure is unrelated to the files changed in this PR.

[vercel]

@bhavyajain0810 is attempting to deploy a commit to the CodeBlooded's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Hi @bhavyajain0810, thanks for contributing to Nyay Setu! 🎉

I have automatically:

• 👤 Assigned this PR to you.
• 🏷️ Applied the gssoc:approved label.

Our workflows will now analyze your changes to classify:

• 📈 PR Difficulty: level:*
• 🧩 PR Type: type:*
• 🌟 PR Quality: quality:*

Tip

Ensure your PR description references the issue it resolves (e.g. Closes #123). This allows the bot to inherit any additional labels from that issue!

Happy coding! 🚀

[bhavyajain0810]

@viru0909-dev , Please review the PR #1632