feat: add IP-based rate limiting for login and reset-password

back-end/README.md

@@ -55,6 +55,9 @@ To setup the frontend application, Follow the complete setup process below..
     python -m setuptools --version
     ```
 
+- **Redis 7.0+**
+  - Required for IP-based rate limiting on sensitive endpoints. The `IpResetPasswordUniqueEmailGuard` uses the `EXPIRE ... NX` option introduced in Redis 7.0. Earlier versions don't support this syntax and will return an error, so this guard requires Redis 7.0+ to function correctly.
+
 - **Docker Desktop with Kubernetes enabled**
   - Enable Kubernetes: Docker Desktop → Settings → Kubernetes → Enable Kubernetes → Apply & Restart.
 

back-end/apps/api/src/auth/auth.controller.spec.ts

@@ -10,7 +10,12 @@ import { AuthController } from './auth.controller';
 
 import { AuthService } from './auth.service';
 
-import { EmailThrottlerGuard } from '../guards';
+import {
+  EmailThrottlerGuard,
+  IpLoginThrottlerGuard,
+  IpResetPasswordThrottlerGuard,
+  IpResetPasswordUniqueEmailGuard,
+} from '../guards';
 
 jest.mock('passport-jwt', () => ({
   ExtractJwt: {
@@ -47,6 +52,12 @@ describe('AuthController', () => {
     })
       .overrideGuard(EmailThrottlerGuard)
       .useValue(guardMock())
+      .overrideGuard(IpLoginThrottlerGuard)
+      .useValue(guardMock())
+      .overrideGuard(IpResetPasswordThrottlerGuard)
+      .useValue(guardMock())
+      .overrideGuard(IpResetPasswordUniqueEmailGuard)
+      .useValue(guardMock())
       .compile();
 
     controller = module.get<AuthController>(AuthController);

back-end/apps/api/src/auth/auth.controller.ts

@@ -14,6 +14,9 @@ import {
   EmailThrottlerGuard,
   extractJwtAuth,
   extractJwtOtp,
+  IpLoginThrottlerGuard,
+  IpResetPasswordThrottlerGuard,
+  IpResetPasswordUniqueEmailGuard,
   JwtAuthGuard,
   JwtBlackListAuthGuard,
   JwtBlackListOtpGuard,
@@ -80,7 +83,7 @@ export class AuthController {
   })
   @Post('/login')
   @HttpCode(200)
-  @UseGuards(LocalAuthGuard, EmailThrottlerGuard)
+  @UseGuards(EmailThrottlerGuard, IpLoginThrottlerGuard, LocalAuthGuard)
   @Serialize(LoginResponseDto)
   async login(@GetUser() user: User) {
     const accessToken = await this.authService.login(user);
@@ -133,7 +136,7 @@ export class AuthController {
   })
   @Post('/reset-password')
   @HttpCode(200)
-  @UseGuards(EmailThrottlerGuard)
+  @UseGuards(EmailThrottlerGuard, IpResetPasswordUniqueEmailGuard, IpResetPasswordThrottlerGuard)
   async createOtp(@Body() { email }: OtpLocalDto) {
     return this.authService.createOtp(email);
   }

back-end/apps/api/src/guards/index.ts

@@ -2,6 +2,9 @@ export * from './admin.guard';
 export * from './email-throttler.guard';
 export * from './frontend-version.guard';
 export * from './has-key.guard';
+export * from './ip-login-throttler.guard';
+export * from './ip-reset-password-throttler.guard';
+export * from './ip-reset-password-unique-email.guard';
 export * from './ip-throttler.guard';
 export * from './jwt-auth.guard';
 export * from './jwt-blacklist.guard';

back-end/apps/api/src/guards/ip-login-throttler.guard.ts

@@ -0,0 +1,42 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+import { HttpException, HttpStatus, Inject, Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { Reflector } from '@nestjs/core';
+import { seconds, ThrottlerGuard, ThrottlerStorage } from '@nestjs/throttler';
+import { extractClientIp } from '@app/common';
+
+@Injectable()
+export class IpLoginThrottlerGuard extends ThrottlerGuard {
+  constructor(
+    @Inject(ConfigService) configService: ConfigService,
+    @Inject(ThrottlerStorage) storageService: ThrottlerStorage,
+    reflector: Reflector,
+  ) {
+    super(
+      {
+        throttlers: [
+          {
+            name: 'login-ip-minute',
+            ttl: seconds(60),
+            limit: Number(configService.get('LOGIN_IP_MINUTE_LIMIT', 10)),
+          },
+          {
+            name: 'login-ip-ten-second',
+            ttl: seconds(10),
+            limit: Number(configService.get('LOGIN_IP_TEN_SECOND_LIMIT', 2)),
+          },
+        ],
+      },
+      storageService,
+      reflector,
+    );
+  }
+
+  protected getTracker(req: Record<string, any>): Promise<string> {
+    const clientIp = extractClientIp(req);
+    if (!clientIp) {
+      throw new HttpException('Unable to determine client IP', HttpStatus.INTERNAL_SERVER_ERROR);
+    }
+    return Promise.resolve(clientIp);
+  }
+}

back-end/apps/api/src/guards/ip-reset-password-throttler.guard.ts

@@ -0,0 +1,42 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+import { HttpException, HttpStatus, Inject, Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { Reflector } from '@nestjs/core';
+import { seconds, ThrottlerGuard, ThrottlerStorage } from '@nestjs/throttler';
+import { extractClientIp } from '@app/common';
+
+@Injectable()
+export class IpResetPasswordThrottlerGuard extends ThrottlerGuard {
+  constructor(
+    @Inject(ConfigService) configService: ConfigService,
+    @Inject(ThrottlerStorage) storageService: ThrottlerStorage,
+    reflector: Reflector,
+  ) {
+    super(
+      {
+        throttlers: [
+          {
+            name: 'reset-ip-minute',
+            ttl: seconds(60),
+            limit: Number(configService.get('RESET_IP_MINUTE_LIMIT', 5)),
+          },
+          {
+            name: 'reset-ip-ten-second',
+            ttl: seconds(10),
+            limit: Number(configService.get('RESET_IP_TEN_SECOND_LIMIT', 1)),
+          },
+        ],
+      },
+      storageService,
+      reflector,
+    );
+  }
+
+  protected getTracker(req: Record<string, any>): Promise<string> {
+    const clientIp = extractClientIp(req);
+    if (!clientIp) {
+      throw new HttpException('Unable to determine client IP', HttpStatus.INTERNAL_SERVER_ERROR);
+    }
+    return Promise.resolve(clientIp);
+  }
+}

back-end/apps/api/src/guards/ip-reset-password-unique-email.guard.ts

@@ -0,0 +1,51 @@
+import { CanActivate, ExecutionContext, HttpException, HttpStatus, Inject, Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { extractClientIp } from '@app/common';
+import { Redis } from 'ioredis';
+
+const TEN_MINUTES_SECONDS = 600;
+
+@Injectable()
+export class IpResetPasswordUniqueEmailGuard implements CanActivate {
+  private readonly redis: Redis;
+  private readonly limit: number;
+
+  constructor(@Inject(ConfigService) configService: ConfigService) {
+    this.redis = new Redis(configService.getOrThrow('REDIS_URL'));
+    this.limit = Number(configService.get('RESET_IP_UNIQUE_EMAIL_LIMIT', 3));
+  }
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const req = context.switchToHttp().getRequest();
+
+    const ip = extractClientIp(req);
+    if (!ip) {
+      throw new HttpException('Unable to determine client IP', HttpStatus.INTERNAL_SERVER_ERROR);
+    }
+
+    const email: string = req.body?.email;
+    if (!email) return true; // let EmailThrottlerGuard handle the missing email case
+
+    const key = `reset:ip-unique-email:${ip}`;
+
+    // Check current unique email count before adding
+    const countBefore = await this.redis.scard(key);
+    if (countBefore >= this.limit) {
+      throw new HttpException('Too Many Requests', HttpStatus.TOO_MANY_REQUESTS);
+    }
+
+    // Add email to the set and set TTL on first entry.
+    // The 'NX' option sets the expiry only if one is not already present, preserving
+    // the fixed 10-minute window. Requires Redis 7.0+.
+    await this.redis.sadd(key, email);
+    await this.redis.expire(key, TEN_MINUTES_SECONDS, 'NX');
+
+    // Re-check after adding to handle concurrent requests
+    const countAfter = await this.redis.scard(key);
+    if (countAfter > this.limit) {
+      throw new HttpException('Too Many Requests', HttpStatus.TOO_MANY_REQUESTS);
+    }
+
+    return true;
+  }
+}

back-end/apps/api/src/guards/ip-throttler.guard.ts

@@ -3,6 +3,7 @@ import { HttpException, HttpStatus, Inject, Injectable } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { Reflector } from '@nestjs/core';
 import { seconds, ThrottlerGuard, ThrottlerStorage } from '@nestjs/throttler';
+import { extractClientIp } from '@app/common';
 
 @Injectable()
 export class IpThrottlerGuard extends ThrottlerGuard {
@@ -32,7 +33,7 @@ export class IpThrottlerGuard extends ThrottlerGuard {
   }
 
   protected getTracker(req: Record<string, any>): Promise<string> {
-    const clientIp = req.headers['x-forwarded-for'] || req.ip;
+    const clientIp = extractClientIp(req);
     if (!clientIp) {
       throw new HttpException('Unable to determine client IP', HttpStatus.INTERNAL_SERVER_ERROR);
     }

back-end/libs/common/src/utils/extractClientIp.spec.ts

@@ -0,0 +1,99 @@
+import { extractClientIp } from './extractClientIp';
+
+describe('extractClientIp', () => {
+  it('returns the CF-Connecting-IP header when present', () => {
+    const req = {
+      headers: { 'cf-connecting-ip': '203.0.113.9' },
+      ip: '127.0.0.1',
+    };
+
+    expect(extractClientIp(req)).toBe('203.0.113.9');
+  });
+
+  it('trims whitespace from the CF-Connecting-IP header', () => {
+    const req = {
+      headers: { 'cf-connecting-ip': '  203.0.113.9  ' },
+      ip: '127.0.0.1',
+    };
+
+    expect(extractClientIp(req)).toBe('203.0.113.9');
+  });
+
+  it('prefers CF-Connecting-IP over X-Forwarded-For and req.ip', () => {
+    const req = {
+      headers: {
+        'cf-connecting-ip': '203.0.113.9',
+        'x-forwarded-for': '198.51.100.1, 10.0.0.1',
+      },
+      ip: '127.0.0.1',
+    };
+
+    expect(extractClientIp(req)).toBe('203.0.113.9');
+  });
+
+  it('falls back to X-Forwarded-For when CF-Connecting-IP is absent', () => {
+    const req = {
+      headers: { 'x-forwarded-for': '198.51.100.1, 10.0.0.1' },
+      ip: '127.0.0.1',
+    };
+
+    expect(extractClientIp(req)).toBe('198.51.100.1');
+  });
+
+  it('uses the leftmost value and trims it from a multi-value X-Forwarded-For header', () => {
+    const req = {
+      headers: { 'x-forwarded-for': '  198.51.100.1  , 10.0.0.1, 10.0.0.2' },
+      ip: '127.0.0.1',
+    };
+
+    expect(extractClientIp(req)).toBe('198.51.100.1');
+  });
+
+  it('ignores an empty CF-Connecting-IP header and falls back to X-Forwarded-For', () => {
+    const req = {
+      headers: { 'cf-connecting-ip': '   ', 'x-forwarded-for': '198.51.100.1' },
+      ip: '127.0.0.1',
+    };
+
+    expect(extractClientIp(req)).toBe('198.51.100.1');
+  });
+
+  it('ignores an empty X-Forwarded-For header and falls back to req.ip', () => {
+    const req = {
+      headers: { 'x-forwarded-for': '' },
+      ip: '127.0.0.1',
+    };
+
+    expect(extractClientIp(req)).toBe('127.0.0.1');
+  });
+
+  it('falls back to req.ip when headers are missing entirely', () => {
+    const req = { headers: {}, ip: '127.0.0.1' };
+
+    expect(extractClientIp(req)).toBe('127.0.0.1');
+  });
+
+  it('falls back to req.ip when CF-Connecting-IP is provided as a header array (string[])', () => {
+    const req = {
+      headers: { 'cf-connecting-ip': ['203.0.113.9', '203.0.113.10'] },
+      ip: '127.0.0.1',
+    };
+
+    expect(extractClientIp(req)).toBe('127.0.0.1');
+  });
+
+  it('falls back to req.ip when X-Forwarded-For is provided as a header array (string[])', () => {
+    const req = {
+      headers: { 'x-forwarded-for': ['198.51.100.1', '10.0.0.1'] },
+      ip: '127.0.0.1',
+    };
+
+    expect(extractClientIp(req)).toBe('127.0.0.1');
+  });
+
+  it('returns undefined when no IP can be determined', () => {
+    const req = { headers: {}, ip: undefined };
+
+    expect(extractClientIp(req)).toBeUndefined();
+  });
+});

back-end/libs/common/src/utils/extractClientIp.ts

@@ -0,0 +1,27 @@
+/**
+ * Extracts the real client IP from a request.
+ *
+ * Resolution order:
+ * 1. CF-Connecting-IP — set by Cloudflare; not client-controllable.
+ * 2. X-Forwarded-For  — first (leftmost) value, which is the original client
+ *                       IP appended by the first proxy in the chain.
+ * 3. req.ip           — Express fallback (direct connection address).
+ *
+ * Note: X-Forwarded-For is client-controllable when no trusted proxy is
+ * configured. CF-Connecting-IP takes precedence precisely because Cloudflare
+ * strips and rewrites it, making it safe to trust.
+ */
+export function extractClientIp(req: Record<string, any>): string | undefined {
+  const cf = req.headers?.['cf-connecting-ip'];
+  if (cf && typeof cf === 'string' && cf.trim()) {
+    return cf.trim();
+  }
+
+  const forwarded = req.headers?.['x-forwarded-for'];
+  if (forwarded && typeof forwarded === 'string') {
+    const first = forwarded.split(',')[0].trim();
+    if (first) return first;
+  }
+
+  return req.ip;
+}

back-end/libs/common/src/utils/index.ts

@@ -1,4 +1,5 @@
 export * from './buffer';
+export * from './extractClientIp';
 export * from './sdk';
 export * from './mirrorNode';
 export * from './typeORM';