Task: Implement Rate Limiting on Sensitive Public Endpoints #351

New issue

Open

opened 2026-02-28 00:18:11 +00:00 by jjalangtry · 0 comments

jjalangtry commented

2026-02-28 00:18:11 +00:00

(Migrated from github.com)

Implement Rate Limiting on Sensitive Public Endpoints

Description

No rate limiting exists anywhere in the application. Public mutation endpoints can be called unlimited times from any IP, enabling spam, data flooding, and brute-force attacks. The auth endpoint, quote submissions, mentor applications, alumni requests, and email sends are the highest-priority targets.

Associated Epic: #346

Subtasks

Choose a rate limiting strategy: in-memory (viable for single-instance deployments) or Upstash Redis (for distributed/multi-replica setups). Document the choice in a comment in the middleware file
Implement rate limiting in next/proxy.ts (the middleware chain) or as a separate middleware function
Apply limits to the following endpoints:
- /api/auth/* — 10 requests per minute per IP
- POST /api/quotes — 5 submissions per minute per IP
- POST /api/mentor-application — 3 per hour per IP
- POST /api/alumni-requests — 3 per hour per IP
- POST /api/email/send — 5 per minute per IP
Return 429 Too Many Requests with a Retry-After header when the limit is exceeded
Ensure rate limiting does not affect server-to-server calls or CI test runners

Acceptance Criteria

Sending 11 rapid requests to /api/auth/* from the same IP results in a 429 on the 11th
Sending 6 rapid POST requests to /api/quotes returns 429 on the 6th
429 responses include a Retry-After header indicating when the client may retry
Normal usage patterns (one quote submission, one mentor application) are not affected

# Implement Rate Limiting on Sensitive Public Endpoints ## Description No rate limiting exists anywhere in the application. Public mutation endpoints can be called unlimited times from any IP, enabling spam, data flooding, and brute-force attacks. The auth endpoint, quote submissions, mentor applications, alumni requests, and email sends are the highest-priority targets. Associated Epic: #346 ## Subtasks - [ ] Choose a rate limiting strategy: in-memory (viable for single-instance deployments) or Upstash Redis (for distributed/multi-replica setups). Document the choice in a comment in the middleware file - [ ] Implement rate limiting in next/proxy.ts (the middleware chain) or as a separate middleware function - [ ] Apply limits to the following endpoints: - /api/auth/* — 10 requests per minute per IP - POST /api/quotes — 5 submissions per minute per IP - POST /api/mentor-application — 3 per hour per IP - POST /api/alumni-requests — 3 per hour per IP - POST /api/email/send — 5 per minute per IP - [ ] Return 429 Too Many Requests with a Retry-After header when the limit is exceeded - [ ] Ensure rate limiting does not affect server-to-server calls or CI test runners ## Acceptance Criteria - [ ] Sending 11 rapid requests to /api/auth/* from the same IP results in a 429 on the 11th - [ ] Sending 6 rapid POST requests to /api/quotes returns 429 on the 6th - [ ] 429 responses include a Retry-After header indicating when the client may retry - [ ] Normal usage patterns (one quote submission, one mentor application) are not affected