[Security]: No Rate Limiting on Authentication — App Vulnerable to Brute Force Attacks #1303

Problem Statement

The login endpoint has no rate limiting implemented. An attacker can send unlimited
login attempts to guess user passwords without any throttling, lockout, or CAPTCHA.
This puts ALL registered user accounts at risk of being compromised through
automated brute force or credential stuffing attacks.

Proposed Solution

Implement rate limiting on the authentication endpoints:

• Max 5 failed login attempts per IP per 15-minute window
• After 5 failures: return HTTP 429 with a "Too many attempts, try again later" message
• Use a library like express-rate-limit (if Express backend) or Next.js middleware
• Optionally add a cooldown timer displayed to the user on the login page
• Log failed attempts for monitoring purposes

Alternatives Considered

• CAPTCHA on every login — hurts UX for legitimate users; rate limiting is less intrusive.
• Account lockout permanently — too aggressive; timed lockout is the industry standard.

Acceptance Criteria

• After 5 failed attempts from same IP, further attempts return HTTP 429
• Rate limit window resets after 15 minutes
• User sees a clear, friendly error message when rate limited
• Successful logins do not count against the rate limit
• Rate limiting applies to both password login and any OTP/magic link flows
• No performance degradation for normal users

Additional Context

This is a critical security vulnerability (OWASP Top 10 — A07: Identification and
Authentication Failures). Any production app with user accounts must have this.
Reference: express-rate-limit docs — https://www.npmjs.com/package/express-rate-limit