RyderTech/nlcc-itinerary
1
0
Fork 0
Code Issues Pull Requests Packages Activity

rate-limit fixes

Browse Source
This commit is contained in:
Joshua Ryder
2025-10-07 14:19:25 -04:00
parent ffb721a12c
commit 056841dc5e
1 changed files with 16 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
server/api/auth/login.post.ts
View File

@@ -22,14 +22,6 @@ export default defineEventHandler(async (event) => {
'cf-connecting-ip': cfConnectingIp, 'cf-connecting-ip': cfConnectingIp,
'getRequestIP': getRequestIP(event) 'getRequestIP': getRequestIP(event)
}) })
// Check rate limit: 5 attempts per 15 minutes
if (!checkRateLimit(clientIp, 'login', 5, 15)) {
throw createError({
statusCode: 429,
message: 'Too many login attempts. Please try again in 15 minutes.'
})
}
const body = await readBody(event) const body = await readBody(event)
const { username, password } = body const { username, password } = body
@@ -44,6 +36,14 @@ export default defineEventHandler(async (event) => {
const user = getUserByUsername(username.toLowerCase()) const user = getUserByUsername(username.toLowerCase())
if (!user) { if (!user) {
// Check rate limit ONLY on failed attempt
if (!checkRateLimit(clientIp, 'login', 5, 15)) {
console.log(`[LOGIN BLOCKED] Rate limited - Username not found: ${username.toLowerCase()}, IP: ${clientIp}`)
throw createError({
statusCode: 429,
message: 'Too many login attempts. Please try again in 15 minutes.'
})
}
console.log(`[LOGIN FAILED] Username not found: ${username.toLowerCase()}, IP: ${clientIp}`) console.log(`[LOGIN FAILED] Username not found: ${username.toLowerCase()}, IP: ${clientIp}`)
throw createError({ throw createError({
statusCode: 401, statusCode: 401,
@@ -55,6 +55,14 @@ export default defineEventHandler(async (event) => {
const passwordMatch = await bcrypt.compare(password, user.password) const passwordMatch = await bcrypt.compare(password, user.password)
if (!passwordMatch) { if (!passwordMatch) {
// Check rate limit ONLY on failed attempt
if (!checkRateLimit(clientIp, 'login', 5, 15)) {
console.log(`[LOGIN BLOCKED] Rate limited - Invalid password for user: ${username.toLowerCase()}, IP: ${clientIp}`)
throw createError({
statusCode: 429,
message: 'Too many login attempts. Please try again in 15 minutes.'
})
}
console.log(`[LOGIN FAILED] Invalid password for user: ${username.toLowerCase()}, IP: ${clientIp}`) console.log(`[LOGIN FAILED] Invalid password for user: ${username.toLowerCase()}, IP: ${clientIp}`)
throw createError({ throw createError({
statusCode: 401, statusCode: 401,