security: rate-limit + 16KiB body cap on public signup (TODO item 8 remainder) - #103
Closed
lopugit wants to merge 2 commits into
Closed
security: rate-limit + 16KiB body cap on public signup (TODO item 8 remainder)#103lopugit wants to merge 2 commits into
lopugit wants to merge 2 commits into
Conversation
POST /api/v1/auth/register had no throttle and no body-size cap — the last ungated anonymous auth endpoint (login, password-reset, confirm and resend-verification already use enforceRateLimit, and PR #100 covers service-account). Every signup hashes a password and sends a verification email, so unmetered calls were a mass-account + mail-send vector. Adds an admin-editable 'auth.register' rule (20 / 15 min / IP, fail-open like other ordinary user actions) and caps the body at 16 KiB via readJsonBody, mirroring the login route. Seeding and fixtures call registerUser in-process, so they are unaffected. The meta mass-assignment concern from the TODO is already covered: the route whitelists fields and createUserAccount strips privileged meta keys. Live-verified on the worktree dev stack: 20x 200 then 429 with Retry-After; >16 KiB body 413; fresh-window signup still 200. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This was referenced Jul 29, 2026
Owner
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Completes the remaining half of TODO/TODO.md item 8 (auth rate limiting):
POST /api/v1/auth/registerwas the last anonymous auth endpoint with no throttle and no body-size cap. Login, password-reset (+confirm), and resend-verification already useenforceRateLimit, and service-account provisioning is covered by PR #100 — this PR deliberately does not touch that route to avoid overlapping with #100.Changes
auth.registerrate-limit rule (admin-editable via the existing panel): 20 / 15 min, keyed by IP, fail-open like other ordinary user actions. Every signup hashes a password and sends a verification email, so unmetered calls were a mass-account-creation + mail-send vector.readJsonBody, mirroring the login route (previously rawrequest.json()with no bound — and body size is what bounds any persisted field sizes).Not needed from the original TODO text: the
metamass-assignment concern is already fixed on main — the route whitelists fields andcreateUserAccountstrips privileged meta keys at the single chokepoint.Seeding/fixtures are unaffected:
scripts/mongodb/setup.tscallsregisterUserin-process, not over HTTP.Live verification (worktree dev stack, real API)
200, 21st →429+Retry-After413 Payload Too Large200, cookie set, user createdNote for reviewers:
config.tswill have a trivial adjacent-line conflict with PR #100 (both append a rule afterauth.login).🤖 Generated with Claude Code