feat: Adjust rate limiting configuration for authentication endpoints

- Increase auth endpoint rate limit from 5 to 20 requests per 5 minutes
- Add debug logging for rate limit checks to aid in monitoring and troubleshooting
- Provide more visibility into rate limiting behavior with detailed console debug message

commit: e6d248973bf9af2ed7a2655c7063cfeedd0f562b
author: Kit · 20mo ago · 2025-02-14 13:14 UTC
parent: 5367de1
signature: SSH UnverifiedSHA256:H91DFuEG4jpk5edzLA4aUKkpv4zv9Q339ipRmkph6Tk The key is unknown

1 file · +3 -1

M src/lib/api/rate-limiter.ts +3 -1


@@ -3,7 +3,7 @@ import type { RequestEvent } from '@sveltejs/kit';
3	3		// Rate limit configuration by endpoint type
4	4		const RATE_LIMITS = {
5	5		// Authentication endpoints (login, register)
6		-	auth: { points: 5, durationMs: 5 * 60 * 1000 }, // 5 requests per 5 minutes
	6	+	auth: { points: 20, durationMs: 5 * 60 * 1000 }, // 20 requests per 5 minutes
7	7
8	8		// Public endpoints (public chat, rooms)
9	9		public: { points: 30, durationMs: 60 * 1000 }, // 30 requests per minute

@@ -82,6 +82,8 @@ function isRateLimited(ip: string, endpointType: keyof typeof RATE_LIMITS, isAut
82	82		const requests = ipRequests.get(ip) \|\| [];
83	83		const validRequests = requests.filter(req => now - req.timestamp < durationMs);
84	84
	85	+	console.debug(`Rate limit check for ${ip} on ${endpointType}: ${validRequests.length}/${points} requests in the last ${durationMs/1000}s`);
	86	+
85	87		if (validRequests.length >= points) {
86	88		const oldestRequest = validRequests[0];
87	89		const retryAfter = durationMs - (now - oldestRequest.timestamp);

 // Rate limit configuration by endpoint type
 const RATE_LIMITS = {
     // Authentication endpoints (login, register)
-    auth: { points: 5, durationMs: 5 * 60 * 1000 }, // 5 requests per 5 minutes
+    auth: { points: 20, durationMs: 5 * 60 * 1000 }, // 20 requests per 5 minutes
     // Public endpoints (public chat, rooms)
     public: { points: 30, durationMs: 60 * 1000 }, // 30 requests per minute
     const requests = ipRequests.get(ip) || [];
     const validRequests = requests.filter(req => now - req.timestamp < durationMs);
+    console.debug(`Rate limit check for ${ip} on ${endpointType}: ${validRequests.length}/${points} requests in the last ${durationMs/1000}s`);
     if (validRequests.length >= points) {
         const oldestRequest = validRequests[0];
         const retryAfter = durationMs - (now - oldestRequest.timestamp);