feat: implement short-lived grant system for OTP verification and enhance rate limiting across authentication endpoints

2026-06-20 12:51:10 +03:30
parent f9678026a8
commit e2636ce743
11 changed files with 396 additions and 107 deletions
@@ -11,3 +11,21 @@ framework:
            policy: 'fixed_window'
            limit: 10
            interval: '1 minute'
+
+        # OTP verify: max 10 attempts per 15 minutes per IP
+        verify_code:
+            policy: 'sliding_window'
+            limit: 10
+            interval: '15 minutes'
+
+        # Token issuance (oauth/token, otp-login): max 10 per 5 minutes per IP
+        token_issue:
+            policy: 'sliding_window'
+            limit: 10
+            interval: '5 minutes'
+
+        # Password reset: max 5 per hour per IP
+        password_reset:
+            policy: 'sliding_window'
+            limit: 5
+            interval: '60 minutes'