Rate limiting on API endpoints #25

New issue

Open

opened 2026-04-19 07:23:34 +00:00 by forgejo-lila · 0 comments

forgejo-lila commented

2026-04-19 07:23:34 +00:00

Owner

Context

The API has no rate limiting. Vulnerable to brute force attacks on auth endpoints and spam on game endpoints.

What to do

Add rate limiting middleware to the Express API.

Files to change

apps/api/package.json — add express-rate-limit (or similar)
apps/api/src/app.ts — apply rate limiter middleware. Different limits for:
- Auth endpoints (/api/auth/*): strict (e.g. 10 req/min per IP)
- Game endpoints (/api/v1/game/*): moderate (e.g. 60 req/min per IP)
- Health endpoint (/api/v1/health): relaxed or exempt
Alternatively, rate limiting can be done at the Caddy level — evaluate both.

Acceptance criteria

Excessive requests from a single IP receive 429 Too Many Requests
Normal usage is not affected
Rate limit headers in responses (X-RateLimit-Limit, X-RateLimit-Remaining)
Auth endpoints have stricter limits than game endpoints
Document the chosen limits in documentation/decisions.md

Notes

The API runs behind Caddy reverse proxy. req.ip will show Caddy's internal IP unless trust proxy is configured in Express. The app currently sets up Express in apps/api/src/app.ts via createApp() factory function.

## Context The API has no rate limiting. Vulnerable to brute force attacks on auth endpoints and spam on game endpoints. ## What to do Add rate limiting middleware to the Express API. ## Files to change - `apps/api/package.json` — add `express-rate-limit` (or similar) - `apps/api/src/app.ts` — apply rate limiter middleware. Different limits for: - Auth endpoints (`/api/auth/*`): strict (e.g. 10 req/min per IP) - Game endpoints (`/api/v1/game/*`): moderate (e.g. 60 req/min per IP) - Health endpoint (`/api/v1/health`): relaxed or exempt - Alternatively, rate limiting can be done at the Caddy level — evaluate both. ## Acceptance criteria - Excessive requests from a single IP receive 429 Too Many Requests - Normal usage is not affected - Rate limit headers in responses (`X-RateLimit-Limit`, `X-RateLimit-Remaining`) - Auth endpoints have stricter limits than game endpoints - Document the chosen limits in `documentation/decisions.md` ## Notes The API runs behind Caddy reverse proxy. `req.ip` will show Caddy's internal IP unless `trust proxy` is configured in Express. The app currently sets up Express in `apps/api/src/app.ts` via `createApp()` factory function.