Skip to content

feat: add rate limiting to authentication routes #59

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jikrana1 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat: add rate limiting to authentication routes #59

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions backend/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions backend/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@
"cors": "^2.8.5",
"dotenv": "^16.5.0",
"express": "^4.18.2",
"express-rate-limit": "^8.5.2",
"jsonwebtoken": "^9.0.3",
"mongodb": "^7.2.0",
"mongoose": "^8.14.3",
Expand Down
10 changes: 10 additions & 0 deletions backend/src/middleware/authRateLimiter.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
export const authLimiter = rateLimit({

@coderabbitai coderabbitai Bot Jun 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify unresolved usage of `rateLimit` and whether import exists.
rg -n -C2 '\brateLimit\s*\(' backend/src/middleware/authRateLimiter.js
rg -n -C2 'from\s+"express-rate-limit"|from\s+'\''express-rate-limit'\''' backend/src/middleware/authRateLimiter.js

Repository: niharika-mente/ThinkBoard

Length of output: 166

🏁 Script executed:

#!/bin/bash
# Get full file content to check for any imports
cat -n backend/src/middleware/authRateLimiter.js

Repository: niharika-mente/ThinkBoard

Length of output: 390

🏁 Script executed:

#!/bin/bash
# Check if express-rate-limit is in package.json dependencies
rg '"express-rate-limit"' package.json -A2 -B2

Repository: niharika-mente/ThinkBoard

Length of output: 51

🏁 Script executed:

#!/bin/bash
# Check package.json structure
head -50 package.json | cat -n

Repository: niharika-mente/ThinkBoard

Length of output: 489

🏁 Script executed:

#!/bin/bash
# Search more broadly for rate-limit mentions
rg 'rate.limit|rateLimit' package.json -i

Repository: niharika-mente/ThinkBoard

Length of output: 51

🏁 Script executed:

#!/bin/bash
# Check how authRateLimiter is imported in routes to understand context
rg -l 'authRateLimiter\|authLimiter' backend/src --type js

Repository: niharika-mente/ThinkBoard

Length of output: 51

🏁 Script executed:

#!/bin/bash
# Check backend package.json
cat -n backend/package.json | head -50

Repository: niharika-mente/ThinkBoard

Length of output: 968

🏁 Script executed:

#!/bin/bash
# Search for express-rate-limit throughout backend
rg 'express-rate-limit' backend/

Repository: niharika-mente/ThinkBoard

Length of output: 473

🏁 Script executed:

#!/bin/bash
# Check how rateLimit is imported elsewhere in the codebase
rg 'import.*rateLimit' backend/src -A2 -B2

Repository: niharika-mente/ThinkBoard

Length of output: 309

🏁 Script executed:

#!/bin/bash
# Check what's in the rateLimiter.js middleware file
cat -n backend/src/middleware/rateLimiter.js

Repository: niharika-mente/ThinkBoard

Length of output: 797

🏁 Script executed:

#!/bin/bash
# Check if authLimiter is imported/used anywhere
rg 'authLimiter|authRateLimiter' backend/src

Repository: niharika-mente/ThinkBoard

Length of output: 493

Missing rateLimit import causes module load failure.

The file exports authLimiter using rateLimit() but never imports it. When authRoutes.js imports this middleware for the register, login, and logout endpoints, the module will fail to load with a ReferenceError, breaking auth route initialization.

Add the import statement:

Suggested fix 
+import { rateLimit } from "express-rate-limit";
+
 export const authLimiter = rateLimit({
   windowMs: 15 * 60 * 1000, // 15 minutes
   max: 5,
   message: {
     success: false,
     message: "Too many requests, please try again after 15 minutes.",
   },
   standardHeaders: true,
   legacyHeaders: false,
 });
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
export const authLimiter = rateLimit({
import { rateLimit } from "express-rate-limit";
export const authLimiter = rateLimit({
windowMs: 15 * 60 * 1000, // 15 minutes
max: 5,
message: {
success: false,
message: "Too many requests, please try again after 15 minutes.",
},
standardHeaders: true,
legacyHeaders: false,
});
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@backend/src/middleware/authRateLimiter.js` at line 1, The authRateLimiter.js
file uses the rateLimit function to create the authLimiter export but does not
import it, causing a ReferenceError when the module loads. Add an import
statement at the top of the file to import rateLimit from the express-rate-limit
package before the authLimiter export definition.

windowMs: 15 * 60 * 1000, // 15 minutes
max: 5,
message: {
success: false,
message: "Too many requests, please try again after 15 minutes.",
},
standardHeaders: true,
legacyHeaders: false,
});
7 changes: 4 additions & 3 deletions backend/src/routes/authRoutes.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,13 @@ import express from "express";
const authRouter = express.Router();
import { register,login,getCurrentUser, logout } from "../controllers/userAuth.js";
import { authenticateUser } from "../middleware/authMiddleware.js";
import { authLimiter } from "../middleware/authRateLimiter.js";


authRouter.post("/register", register);
authRouter.post("/login", login);
authRouter.post("/register",authLimiter, register);
authRouter.post("/login", authLimiter, login);
authRouter.get("/me", authenticateUser, getCurrentUser);
authRouter.post("/logout", logout);
authRouter.post("/logout",authLimiter, logout);


export default authRouter;