Add rate limiting to auth endpoints

[bgorzelic]

Problem

The auth endpoints (login, register, password reset) have no rate limiting beyond the 5-minute token resend cooldown. This makes the application vulnerable to brute-force attacks, credential stuffing, and abuse of the email sending functionality.

Proposed Implementation

Option A: Vercel Edge Config + KV Rate Limiter

Use @vercel/kv or @upstash/ratelimit for serverless-compatible rate limiting:

• Login: 5 attempts per 15 minutes per IP
• Register: 3 accounts per hour per IP
• Password reset: 3 requests per hour per IP
• 2FA verification: 5 attempts per 15 minutes per user

Option B: In-Memory Rate Limiting (simpler)

Use a Map-based rate limiter for development, with a note to upgrade to distributed rate limiting in production.

Option A is recommended for production.

Acceptance Criteria

• Login attempts are rate-limited per IP
• Registration is rate-limited per IP
• Password reset requests are rate-limited per IP
• 2FA attempts are rate-limited per user
• Rate limit errors return clear messages to the user
• Rate limiting works across serverless function instances (distributed)
• Legitimate users are not affected by reasonable limits

[zuberkhan01st]

Hi @bgorzelic 👋

I’d like to work on implementing rate limiting for the auth endpoints.

I agree that distributed rate limiting (e.g., using @upstash/ratelimit or @vercel/kv) is the correct approach for production, especially to ensure consistency across serverless instances.

My approach would be:

• Introduce a shared rate limiter utility
• Apply per-IP limits for login, register, and password reset
• Apply per-user limits for 2FA verification
• Return clear, structured error responses on limit violations
• Ensure limits are configurable via environment variables
• Add tests to verify rate limiting behavior

If this approach aligns with your expectations, I’d be happy to take this on.

Could you please assign it to me?