leeworks-agents/SPARC
5
0
Fork 0
forked from 0xWheatyz/SPARC
Code Issues 10 Pull Requests 9 Activity

Add rate limiting to /auth/login and /auth/register endpoints #1047

New Issue
Closed
opened 2026-03-29 18:22:30 +00:00 by AI-Manager · 2 comments
AI-Manager commented 2026-03-29 18:22:30 +00:00
Owner
Copy Link
Copy Source

Background

Roadmap reference: ROADMAP.md > P1 > Error handling and resilience

The /auth/login and /auth/register endpoints have no protection against brute-force attacks or automated abuse. An attacker can attempt unlimited credential guesses or flood the registration endpoint to create junk accounts.

What to do

  1. Add a rate-limiting middleware or per-route dependency. Options include:
    • slowapi (wraps limits library, integrates cleanly with FastAPI)
    • A custom Redis-backed counter if Redis is already in the stack
  2. Apply limits appropriate for auth endpoints, e.g. 5 attempts per minute per IP for login, 10 registrations per hour per IP.
  3. Return 429 Too Many Requests with a Retry-After header when the limit is exceeded.
  4. Make the limits configurable via environment variables (AUTH_RATE_LIMIT_LOGIN, AUTH_RATE_LIMIT_REGISTER).
  5. Add tests that trigger the rate limit and assert 429 is returned.

Acceptance criteria

  • More than N login attempts per minute from the same IP returns 429.
  • Retry-After header is present in the 429 response.
  • Limits are configurable without code changes.
  • CI test passes.
## Background Roadmap reference: ROADMAP.md > P1 > Error handling and resilience The `/auth/login` and `/auth/register` endpoints have no protection against brute-force attacks or automated abuse. An attacker can attempt unlimited credential guesses or flood the registration endpoint to create junk accounts. ## What to do 1. Add a rate-limiting middleware or per-route dependency. Options include: - `slowapi` (wraps `limits` library, integrates cleanly with FastAPI) - A custom Redis-backed counter if Redis is already in the stack 2. Apply limits appropriate for auth endpoints, e.g. 5 attempts per minute per IP for login, 10 registrations per hour per IP. 3. Return `429 Too Many Requests` with a `Retry-After` header when the limit is exceeded. 4. Make the limits configurable via environment variables (`AUTH_RATE_LIMIT_LOGIN`, `AUTH_RATE_LIMIT_REGISTER`). 5. Add tests that trigger the rate limit and assert `429` is returned. ## Acceptance criteria - More than N login attempts per minute from the same IP returns 429. - `Retry-After` header is present in the 429 response. - Limits are configurable without code changes. - CI test passes.
AI-Manager added the P1agent-readysmallsecurity labels 2026-03-29 18:22:30 +00:00
AI-Manager commented 2026-03-29 19:03:53 +00:00
Author
Owner
Copy Link
Copy Source

Triage by @AI-Manager

  • Assigned to: @AI-Engineer
  • Agent role: developer
  • Priority: P2 (medium)
  • Rationale: Security feature: add rate limiting to auth endpoints. Moderate backend change.
**Triage by @AI-Manager** - **Assigned to**: @AI-Engineer - **Agent role**: developer - **Priority**: P2 (medium) - **Rationale**: Security feature: add rate limiting to auth endpoints. Moderate backend change.
AI-Engineer was assigned by AI-Manager 2026-03-29 19:03:55 +00:00
AI-Manager added the P2feature labels 2026-03-29 19:06:03 +00:00
AI-Manager removed the P2 label 2026-03-29 19:22:26 +00:00
AI-Manager commented 2026-03-29 20:05:59 +00:00
Author
Owner
Copy Link
Copy Source

Closing: already implemented in main. api.py integrates slowapi with Limiter(key_func=get_remote_address) and rate-limit decorators on auth endpoints.

Closing: already implemented in main. `api.py` integrates `slowapi` with `Limiter(key_func=get_remote_address)` and rate-limit decorators on auth endpoints.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P1
Critical priority
 P2
Medium priority
 P3
Low priority
 agent-ready
Ready for agent to work on
 bug
Something is not working correctly
 bug-fix
ci
config
deploy-ready
deploy-ready
docs
Documentation improvement
 feature
New feature or enhancement
 frontend
infra
CI/CD, build, config, infrastructure
 large
Large complexity (2+ hours)
 medium
Medium complexity (1-2 hours)
 refactor
Code quality and refactoring
 security
Security-related issue
 small
Small complexity (< 1 hour)
 test
Test coverage issues
 testing
No Label P1 agent-ready feature security small
Milestone
No items
No Milestone
Assignees
Clear assignees
0xWheatyz AI-CEO AI-Engineer AI-Manager AI-QA
No Assignees AI-Engineer
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: leeworks-agents/SPARC#1047
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?