Closes #452

Summary

Adds focused authentication rate limiting for sensitive auth endpoints using express-rate-limit.

Previously, authentication endpoints had no throttling or abuse protection, allowing:

• unlimited credential stuffing attempts
• brute-force login attacks
• password spraying
• and bcrypt-driven CPU exhaustion attacks

Because every login request reached synchronous bcryptjs password verification with no request throttling.

This PR introduces scoped rate limiting for authentication-sensitive routes while preserving the existing auth/session behavior and response contracts.

Implementation

Added express-rate-limit and configured dedicated auth limiters for:

• POST /api/auth/login
• POST /api/auth/signup

Limiter configuration:

windowMs: 15 * 60 * 1000
max: 10
standardHeaders: true
legacyHeaders: false

Key changes:

• added auth-specific request throttling
• enabled standard rate-limit headers
• disabled legacy rate-limit headers
• preserved existing auth route behavior
• preserved existing login/signup response contracts
• avoided global middleware throttling

The limiter is intentionally scoped only to authentication-sensitive routes.

Files Changed

• backend/config/authRateLimit.js
• backend/routes/auth.js
• backend/package.json
• package.json
• spec/auth.rate-limit.spec.cjs

Security Improvements

This reduces exposure to:

• credential stuffing attacks
• automated brute-force attempts
• password spraying
• event-loop degradation from repeated bcrypt operations
• automated authentication abuse

Excessive requests now return:

429 Too Many Requests

with standard rate-limit headers enabled.

Tests

Focused regression coverage added for:

• login limiter blocks excessive requests
• signup limiter blocks excessive requests
• HTTP 429 responses returned correctly
• standard rate-limit headers present
• legitimate requests still succeed under threshold

Verification

npx.cmd jasmine spec/auth.rate-limit.spec.cjs

Result:

5 specs, 0 failures

Full backend suite was also attempted:

npm.cmd run test:backend

Existing unrelated MongoDB-dependent auth/model specs timed out locally, while all newly-added auth rate-limit tests passed successfully.

Notes

This PR intentionally keeps scope limited to authentication abuse protection.

No CAPTCHA, Redis, account-lockout system, auth architecture rewrite, or unrelated middleware refactors were introduced.