fix: harden authentication routes against NoSQL injection attacks

[Rishishinde08]

Security Improvements

Implemented comprehensive security hardening for authentication routes to prevent NoSQL injection vulnerabilities and improve OTP verification security.

Fixes Implemented

• Added strict email validation middleware using express-validator
• Prevented MongoDB operator injection attacks
• Added malicious payload detection for authentication routes
• Hardened /verify, /resend_otp, and /signin endpoints
• Improved OTP comparison security using constant-time comparison
• Added sanitized and normalized email handling
• Improved backend authentication security and request validation

Additional Security Hardening

• Added malicious payload detection
• Improved rate limiting validation
• Prevented unsafe MongoDB query execution
• Enhanced authentication route protection

Security Testing

Malicious Payload Test

{
  "email": {
    "$ne": ""
  },
  "otp_value": "1234"
}

Result:

• Request safely rejected with validation errors
• No MongoDB query operator execution occurred

Valid Payload Test

{
  "email": "test@gmail.com",
  "otp_value": "1234"
}

Result:

• Request processed normally
• Authentication flow remained functional

Protected Routes

• /verify
• /resend_otp
• /signin

[vercel]

@Rishishinde08 is attempting to deploy a commit to the Sunil Kumar's projects Team on Vercel.

A member of the Team first needs to authorize it.

[Rishishinde08]

Implemented a comprehensive security hardening fix for the authentication routes and raised a PR addressing the NoSQL injection vulnerability along with additional authentication security improvements.