fix: login and password reset requests are rate-limited per client (not in the README; there is currently no brute-force protection on the public auth routes)

api/router.go

@@ -52,15 +52,23 @@ func NewArticleRouter(container *UseCases) http.Handler {
 	return r
 }
 
-func NewAuthRouter(container *UseCases, isProduction bool) http.Handler {
+func NewAuthRouter(container *UseCases, isProduction bool, rateLimit config.AuthRateLimitSettings) http.Handler {
 	r := chi.NewRouter()
 
 	authHandler := auth.NewHandler(container.Token, container.GetUserUseCase, container.ListUsersUseCase, container.CreateUserUseCase, container.AuthenticateUserUseCase, container.VerifyUserUseCase, container.CancelRegistrationUseCase, container.RequestPasswordResetUseCase, container.ResetPasswordUseCase, isProduction)
 
 	r.Post("/register", authHandler.Register)
-	r.Post("/login", authHandler.Login)
+	r.Group(func(r chi.Router) {
+		r.Use(chimiddleware.RealIP)
+		r.Use(middleware.NewRateLimiter(rateLimit.MaxAttempts, rateLimit.Window))
+		r.Post("/login", authHandler.Login)
+	})
 	r.Post("/logout", authHandler.Logout)
-	r.Post("/password-reset", authHandler.RequestPasswordReset)
+	r.Group(func(r chi.Router) {
+		r.Use(chimiddleware.RealIP)
+		r.Use(middleware.NewRateLimiter(rateLimit.MaxAttempts, rateLimit.Window))
+		r.Post("/password-reset", authHandler.RequestPasswordReset)
+	})
 	r.Post("/password-reset/confirm", authHandler.ResetPassword)
 	r.Group(func(r chi.Router) {
 		r.Use(jwtauth.Verifier(container.Token))
@@ -84,7 +92,7 @@ func InitBackendRoutes(container *UseCases, settings config.Settings) *chi.Mux {
 		r.Use(jwtauth.Verifier(container.Token))
 		r.Mount("/article", NewArticleRouter(container))
 	})
-	r.Mount("/auth", NewAuthRouter(container, settings.IsProduction()))
+	r.Mount("/auth", NewAuthRouter(container, settings.IsProduction(), settings.AuthRateLimit))
 
 	return r
 }