Description
The POST /api/v1/token/ and POST /api/v1/auth/register/ endpoints currently do not have rate limiting, making them vulnerable to brute force and credential stuffing attacks.
Steps to Reproduce
- Send 100 rapid requests to
/api/v1/token/ with wrong passwords.
- Observe all requests are processed without being blocked.
Expected Behavior
Implement Django REST Framework's AnonRateThrottle on the authentication views.
Implementation Hints
# backend/users/views.py
from rest_framework.throttling import AnonRateThrottle
class CustomTokenObtainPairView(TokenObtainPairView):
throttle_classes = [AnonRateThrottle]
Description
The
POST /api/v1/token/andPOST /api/v1/auth/register/endpoints currently do not have rate limiting, making them vulnerable to brute force and credential stuffing attacks.Steps to Reproduce
/api/v1/token/with wrong passwords.Expected Behavior
Implement Django REST Framework's
AnonRateThrottleon the authentication views.Implementation Hints