Describe the bug 📝
The backend API currently lacks rate limiting and centralized input validation. Sensitive endpoints like /api/auth/login, /api/auth/register, and /api/blogs can be hit an unlimited number of times, making the system vulnerable to brute-force attacks and DDoS. Additionally, there is no schema-based validation for request bodies, which can result in malformed data entering the database.
Expected behavior ✅
- Rate Limiting: Requests from a single IP should be limited (e.g., 5-10 attempts per minute for auth routes).
- Validation: Every POST/PUT request should be validated against a strict schema (using Zod or Joi) before reaching the controller.
- Security Headers: The server should send standard security headers (like those provided by
helmet).
Environment 🌍
- OS: Any (Backend)
- Version: Node.js/Express Environment
Additional context 💬
- No
express-rate-limit or helmet middleware is found in backend/src/app.js.
- Controllers in backend/src/routes/auth.route.js are executed without any validation middleware, risking
500 Internal Server Error or database corruption from invalid payloads.
Assign this issue to me under the OSCG
Describe the bug 📝
The backend API currently lacks rate limiting and centralized input validation. Sensitive endpoints like
/api/auth/login,/api/auth/register, and/api/blogscan be hit an unlimited number of times, making the system vulnerable to brute-force attacks and DDoS. Additionally, there is no schema-based validation for request bodies, which can result in malformed data entering the database.Expected behavior ✅
helmet).Environment 🌍
Additional context 💬
express-rate-limitorhelmetmiddleware is found in backend/src/app.js.500 Internal Server Erroror database corruption from invalid payloads.Assign this issue to me under the OSCG