From 647e13d65448ab9965c17746eb0091cc05d24877 Mon Sep 17 00:00:00 2001 From: Scott Wilson Date: Mon, 23 Jun 2025 10:27:36 -0700 Subject: [PATCH 1/2] improvement: add more aggressive rate limiting to verify endpoints --- backend/src/server/routes/v1/password-router.ts | 4 +++- backend/src/server/routes/v2/user-router.ts | 6 ++++-- backend/src/server/routes/v3/signup-router.ts | 4 +++- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/backend/src/server/routes/v1/password-router.ts b/backend/src/server/routes/v1/password-router.ts index eeb730f29..7e2059cae 100644 --- a/backend/src/server/routes/v1/password-router.ts +++ b/backend/src/server/routes/v1/password-router.ts @@ -107,7 +107,9 @@ export const registerPasswordRouter = async (server: FastifyZodProvider) => { method: "POST", url: "/email/password-reset-verify", config: { - rateLimit: authRateLimit + rateLimit: smtpRateLimit({ + keyGenerator: (req) => (req.body as { email?: string })?.email?.trim().substring(0, 100) ?? req.realIp + }) }, schema: { body: z.object({ diff --git a/backend/src/server/routes/v2/user-router.ts b/backend/src/server/routes/v2/user-router.ts index bbd566334..97b78bda5 100644 --- a/backend/src/server/routes/v2/user-router.ts +++ b/backend/src/server/routes/v2/user-router.ts @@ -2,7 +2,7 @@ import { z } from "zod"; import { AuthTokenSessionsSchema, UserEncryptionKeysSchema, UsersSchema } from "@app/db/schemas"; import { ApiKeysSchema } from "@app/db/schemas/api-keys"; -import { authRateLimit, readLimit, smtpRateLimit, writeLimit } from "@app/server/config/rateLimiter"; +import { readLimit, smtpRateLimit, writeLimit } from "@app/server/config/rateLimiter"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; import { AuthMethod, AuthMode, MfaMethod } from "@app/services/auth/auth-type"; import { sanitizedOrganizationSchema } from "@app/services/org/org-schema"; @@ -34,7 +34,9 @@ export const registerUserRouter = async (server: FastifyZodProvider) => { method: "POST", url: "/me/emails/verify", config: { - rateLimit: authRateLimit + rateLimit: smtpRateLimit({ + keyGenerator: (req) => (req.body as { username?: string })?.username?.trim().substring(0, 100) ?? req.realIp + }) }, schema: { body: z.object({ diff --git a/backend/src/server/routes/v3/signup-router.ts b/backend/src/server/routes/v3/signup-router.ts index c249e7dbe..644235cd6 100644 --- a/backend/src/server/routes/v3/signup-router.ts +++ b/backend/src/server/routes/v3/signup-router.ts @@ -55,7 +55,9 @@ export const registerSignupRouter = async (server: FastifyZodProvider) => { url: "/email/verify", method: "POST", config: { - rateLimit: authRateLimit + rateLimit: smtpRateLimit({ + keyGenerator: (req) => (req.body as { email?: string })?.email?.trim().substring(0, 100) ?? req.realIp + }) }, schema: { body: z.object({ From 2137d1315792c848f913a9261bed69508b3beb15 Mon Sep 17 00:00:00 2001 From: Scott Wilson Date: Mon, 23 Jun 2025 10:36:09 -0700 Subject: [PATCH 2/2] improve key check operator --- backend/src/server/routes/v1/invite-org-router.ts | 2 +- backend/src/server/routes/v1/password-router.ts | 4 ++-- backend/src/server/routes/v2/user-router.ts | 4 ++-- backend/src/server/routes/v3/signup-router.ts | 4 ++-- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/backend/src/server/routes/v1/invite-org-router.ts b/backend/src/server/routes/v1/invite-org-router.ts index 525d51913..b688dc042 100644 --- a/backend/src/server/routes/v1/invite-org-router.ts +++ b/backend/src/server/routes/v1/invite-org-router.ts @@ -83,7 +83,7 @@ export const registerInviteOrgRouter = async (server: FastifyZodProvider) => { config: { rateLimit: smtpRateLimit({ keyGenerator: (req) => - (req.body as { membershipId?: string })?.membershipId?.trim().substring(0, 100) ?? req.realIp + (req.body as { membershipId?: string })?.membershipId?.trim().substring(0, 100) || req.realIp }) }, method: "POST", diff --git a/backend/src/server/routes/v1/password-router.ts b/backend/src/server/routes/v1/password-router.ts index 7e2059cae..3396cebe9 100644 --- a/backend/src/server/routes/v1/password-router.ts +++ b/backend/src/server/routes/v1/password-router.ts @@ -81,7 +81,7 @@ export const registerPasswordRouter = async (server: FastifyZodProvider) => { url: "/email/password-reset", config: { rateLimit: smtpRateLimit({ - keyGenerator: (req) => (req.body as { email?: string })?.email?.trim().substring(0, 100) ?? req.realIp + keyGenerator: (req) => (req.body as { email?: string })?.email?.trim().substring(0, 100) || req.realIp }) }, schema: { @@ -108,7 +108,7 @@ export const registerPasswordRouter = async (server: FastifyZodProvider) => { url: "/email/password-reset-verify", config: { rateLimit: smtpRateLimit({ - keyGenerator: (req) => (req.body as { email?: string })?.email?.trim().substring(0, 100) ?? req.realIp + keyGenerator: (req) => (req.body as { email?: string })?.email?.trim().substring(0, 100) || req.realIp }) }, schema: { diff --git a/backend/src/server/routes/v2/user-router.ts b/backend/src/server/routes/v2/user-router.ts index 97b78bda5..92b4138f2 100644 --- a/backend/src/server/routes/v2/user-router.ts +++ b/backend/src/server/routes/v2/user-router.ts @@ -13,7 +13,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => { url: "/me/emails/code", config: { rateLimit: smtpRateLimit({ - keyGenerator: (req) => (req.body as { username?: string })?.username?.trim().substring(0, 100) ?? req.realIp + keyGenerator: (req) => (req.body as { username?: string })?.username?.trim().substring(0, 100) || req.realIp }) }, schema: { @@ -35,7 +35,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => { url: "/me/emails/verify", config: { rateLimit: smtpRateLimit({ - keyGenerator: (req) => (req.body as { username?: string })?.username?.trim().substring(0, 100) ?? req.realIp + keyGenerator: (req) => (req.body as { username?: string })?.username?.trim().substring(0, 100) || req.realIp }) }, schema: { diff --git a/backend/src/server/routes/v3/signup-router.ts b/backend/src/server/routes/v3/signup-router.ts index 644235cd6..393b598cf 100644 --- a/backend/src/server/routes/v3/signup-router.ts +++ b/backend/src/server/routes/v3/signup-router.ts @@ -14,7 +14,7 @@ export const registerSignupRouter = async (server: FastifyZodProvider) => { method: "POST", config: { rateLimit: smtpRateLimit({ - keyGenerator: (req) => (req.body as { email?: string })?.email?.trim().substring(0, 100) ?? req.realIp + keyGenerator: (req) => (req.body as { email?: string })?.email?.trim().substring(0, 100) || req.realIp }) }, schema: { @@ -56,7 +56,7 @@ export const registerSignupRouter = async (server: FastifyZodProvider) => { method: "POST", config: { rateLimit: smtpRateLimit({ - keyGenerator: (req) => (req.body as { email?: string })?.email?.trim().substring(0, 100) ?? req.realIp + keyGenerator: (req) => (req.body as { email?: string })?.email?.trim().substring(0, 100) || req.realIp }) }, schema: {