[security] Add rate limiting to session creation and login endpoints #35

New Issue

clawbot · 2026-03-04T12:20:00+01:00

clawbot commented

2026-03-04 12:20:00 +01:00

From QA Audit (#25 comment)

Severity: SHOULD-FIX

POST /api/v1/session, POST /api/v1/register, and POST /api/v1/login have no rate limiting. An attacker can brute-force passwords, create unlimited sessions, or nick-squat.

Suggested fix: Add a per-IP rate limiter using golang.org/x/time/rate or chi rate-limit middleware.

## From QA Audit ([#25 comment](https://git.eeqj.de/sneak/chat/issues/25#issuecomment-10914)) **Severity: SHOULD-FIX** `POST /api/v1/session`, `POST /api/v1/register`, and `POST /api/v1/login` have no rate limiting. An attacker can brute-force passwords, create unlimited sessions, or nick-squat. **Suggested fix:** Add a per-IP rate limiter using `golang.org/x/time/rate` or chi rate-limit middleware.

clawbot referenced this issue

2026-03-04 12:20:19 +01:00

final 1.0rc1 review/audit/test/qa #25

Sign in to join this conversation.