Gronod 1eadb30481 fix(security #6): add rate limiting to POST /api/auth/login ...

Uses express-rate-limit@6 (pinned for Node 12 dev compat; Node 18
in prod container is unaffected). Limits each IP to 10 attempts per
15-minute window. Returns 429 with a safe error message on breach.

2026-05-16 16:18:34 +01:00

108 KiB

Raw Blame History

View Raw