nsc-events-fullstack_32_179-jwt-rate-limit-authentication

[NahomAlemu]

Summary & Changes 📃

• Resolves: Issue: Weak JWT Secret & Missing Rate Limiting on Authentication Endpoints #179

• Summary: Implement strong JWT secret and rate limiting on authentication endpoints

  • 🔨 Fixes weak JWT secret ("secret") that could be brute-forced, and adds rate limiting to prevent credential stuffing and
    brute-force attacks on auth endpoints
  • 👀 Authentication endpoints now reject excessive requests (429 Too Many Requests) and JWT tokens are signed with a
    cryptographically secure 64-character secret
  • 🗨️ Uses @nestjs/throttler package for rate limiting with per-endpoint configuration
  • Changes:
    • ✅ Generated strong 64-character JWT secret using openssl rand -hex 32
    • ✅ Installed and configured @nestjs/throttler in app.module.ts
    • ✅ Applied rate limiting to auth endpoints:
      • Login: 5 attempts/minute per IP
      • Signup: 3 attempts/minute per IP
      • Forgot Password: 3 attempts/minute per IP
      • Reset Password: 3 attempts/minute per IP
    • ✅ Updated .env.example with instructions for generating secure secrets
    • ✅ Updated auth controller tests to include ThrottlerModule
    • 🛠️ No breaking changes - existing functionality unchanged
    • 📝 Rate limit responses return HTTP 429 with retry information

  How to Test 🧪

  1. Steps to Reproduce:
  • Step 1: Start the backend server with npm run start:dev
  • Step 2: Attempt to login more than 5 times within 1 minute using an incorrect password
  • Step 3: Observe the 429 response after exceeding the limit
  2. Expected Behavior: After 5 failed login attempts in 1 minute, subsequent requests return 429 Too Many Requests

Checklist ✅

• I have tested this PR locally and it works as expected.
• This PR resolves an issue (Resolves #issue-number).
• Reviewers, assignees(self), tags, and labels are correctly assigned.
• Squash commits and enable auto-merge if approved.

[github-actions]

✅ Full E2E Test Results

Running full test suite (critical files changed)

Status	Count
✅ Passed	47
❌ Failed	0
📊 Total	47

View detailed report