Merge pull request #1703 from AyushSharma72/ratelimit

added rate limit api to login api

backend/.gitignore

@@ -1 +1,2 @@
-.env
+.env
+/node_modules

backend/package.json

@@ -16,6 +16,7 @@
     "cors": "^2.8.5",
     "dotenv": "^16.4.5",
     "express": "^4.21.1",
+    "express-rate-limit": "^7.4.1",
     "jsonwebtoken": "^9.0.2",
     "mongoose": "^8.7.3"
   }

backend/routes/authRoutes.js

@@ -1,11 +1,26 @@
-const express = require('express');
-const { signup, login, logout, verifyToken } = require('../controllers/authController');
+const express = require("express");
+const rateLimit = require("express-rate-limit");
+const {
+  signup,
+  login,
+  logout,
+  verifyToken,
+} = require("../controllers/authController");
 
 const router = express.Router();
 
-router.post('/signup', signup);
-router.post('/login', login);
-router.post('/logout', logout);
-router.get('/verify', verifyToken); // New verification route
+// Set up rate limiter for the login route
+const loginRateLimiter = rateLimit({
+  windowMs: 5 * 60 * 1000, // 5 minutes
+  max: 5,
+  message: "Too many login attempts. Please try again in 5 minutes.",
+  standardHeaders: true,
+  legacyHeaders: false,
+});
+
+router.post("/signup", signup);
+router.post("/login", loginRateLimiter, login); // Apply the limiter here
+router.post("/logout", logout);
+router.get("/verify", verifyToken);
 
 module.exports = router;