Rate limits on sign-up, sign-in and reset requests, with when to try again

root commented

2026-10-11 16:27:01 +00:00

(Migrated from gitlab.core-project.space)

Imported from GitHub amaurycoudr/chess-project#381, opened by @amaurycoudr on 2026-10-11 16:27 UTC.

Parent

What to build

Sign-up, sign-in and reset requests are rate-limited by in-memory sliding-window counters in the API, on an injected clock. Failed sign-ins are limited per email (5 per 15 minutes) and per IP (20 per 15 minutes). Reset requests are limited per email (3 per hour) and per IP (10 per hour). Sign-ups are limited per IP (10 per hour). Emails are counted lowercased, whether or not they have an Account. The IP is the client's as one trusted proxy hop forwards it. A refused call is TOO_MANY_REQUESTS (429), carrying the seconds to wait in a Retry-After header and in its error data. The sign-up, sign-in and forgot-password forms tell the Player when they can try again. Each limit is a config default that an environment variable may override. Dev, CI and previews raise the per-IP limits so the browser suite can sign up from one address; the per-email limits keep production values everywhere. This ticket writes the rate-limit ADR.

Seam: loadConfig; the RPC wire (with the fake clock); the front views

Acceptance criteria

Each of the five limits is tested one under and at its boundary, with its retry-after, and its window rolling on the fake clock
A limited email reveals nothing: an email with no Account is counted the same way
TOO_MANY_REQUESTS joins the refusal status table as 429 and the errors of signUp, signIn and requestPasswordReset
loadConfig parses the rate-limit overrides, tested beside the existing config tests; dev, CI and previews raise the per-IP limits
The sign-up, sign-in and forgot-password views show the rate-limit message with the wait, in English and French
The rate-limit ADR and its index row land
The ADR is this ticket's first commit, before any code it governs

> _Imported from GitHub [amaurycoudr/chess-project#381](https://github.com/amaurycoudr/chess-project/issues/381), opened by [@amaurycoudr](https://github.com/amaurycoudr) on 2026-10-11 16:27 UTC._  --- ## Parent #364 ## What to build Sign-up, sign-in and reset requests are rate-limited by in-memory sliding-window counters in the API, on an injected clock. Failed sign-ins are limited per email (5 per 15 minutes) and per IP (20 per 15 minutes). Reset requests are limited per email (3 per hour) and per IP (10 per hour). Sign-ups are limited per IP (10 per hour). Emails are counted lowercased, whether or not they have an **Account**. The IP is the client's as one trusted proxy hop forwards it. A refused call is `TOO_MANY_REQUESTS` (429), carrying the seconds to wait in a `Retry-After` header and in its error data. The sign-up, sign-in and forgot-password forms tell the **Player** when they can try again. Each limit is a config default that an environment variable may override. Dev, CI and previews raise the per-IP limits so the browser suite can sign up from one address; the per-email limits keep production values everywhere. This ticket writes the rate-limit ADR. Seam: `loadConfig`; the RPC wire (with the fake clock); the front views ## Acceptance criteria - [ ] Each of the five limits is tested one under and at its boundary, with its retry-after, and its window rolling on the fake clock - [ ] A limited email reveals nothing: an email with no **Account** is counted the same way - [ ] `TOO_MANY_REQUESTS` joins the refusal status table as 429 and the errors of `signUp`, `signIn` and `requestPasswordReset` - [ ] `loadConfig` parses the rate-limit overrides, tested beside the existing config tests; dev, CI and previews raise the per-IP limits - [ ] The sign-up, sign-in and forgot-password views show the rate-limit message with the wait, in English and French - [ ] The rate-limit ADR and its index row land - [ ] The ADR is this ticket's first commit, before any code it governs

root commented

2026-10-11 16:27:01 +00:00

(Migrated from gitlab.core-project.space)

GitHub issue relations, imported as "related" links (GitLab CE has no sub-issues or blocking links).

Parent (sub-issue of): #364
Blocked by: #380
Blocking: #385

> _GitHub issue relations, imported as "related" links (GitLab CE has no sub-issues or blocking links)._  - Parent (sub-issue of): #364 - Blocked by: #380 - Blocking: #385

root commented

2026-10-13 08:39:50 +00:00

(Migrated from gitlab.core-project.space)

mentioned in issue #385