🛡️ Sentinel: Dual Target/IP Rate Limiting for Authentication Server Actions - #99
🛡️ Sentinel: Dual Target/IP Rate Limiting for Authentication Server Actions#99projectamazonph wants to merge 1 commit into
Conversation
- Implement `rateLimitDual` helper function in `src/lib/rate-limit.ts` to combine both email-based and IP-based rate limiting. - Retrieve the client IP address securely via `X-Forwarded-For` first IP or fallback to `X-Real-IP`. - Gracefully bypass IP rate limiting in environments/test setups where headers are not available. - Refactor `signUpAction` and `signInAction` inside `src/app/actions/auth.ts` to call the new dual rate-limiter. - Update `setup.ts`, `auth-actions.test.ts`, `progress-actions.test.ts`, and `tool-actions.test.ts` to properly mock asynchronous Next.js 15 `headers()`. - Add a comprehensive test suite `src/lib/__tests__/rate-limit.test.ts` covering sliding window limits and IP headers, elevating `rate-limit.ts` coverage to 92.59%. Co-authored-by: projectamazonph <286085559+projectamazonph@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
🛡️ Sentinel: Dual Target/IP Rate Limiting for Authentication Server Actions
🚨 Severity: HIGH
💡 Vulnerability: Previously, the authentication actions (
signUpActionandsignInAction) were rate-limited solely by lowercase email address (target-based targeting). This made the application vulnerable to distributed credential stuffing or brute-force attacks where an attacker rotates the target email addresses to completely bypass the target-based limits, potentially flooding the server actions, abusing database queries, and causing performance degradation.🎯 Impact: Credential stuffing, brute-forcing, server resource exhaustion.
🔧 Fix: Implemented a Dual-Target/IP Rate-Limiter helper (
rateLimitDual) that rate-limits by both target email and client IP address (using X-Forwarded-For first entry or X-Real-IP fallback). Integrated it into both authentication actions.✅ Verification: Comprehensive new unit tests added in
src/lib/__tests__/rate-limit.test.tscovering multiple IP header combinations and sliding window mechanics. Verified that the test coverage ofrate-limit.tshas increased to 92.59%, and all linting/building checks pass cleanly.PR created automatically by Jules for task 8652958142022058832 started by @projectamazonph