From 60d138ac33b7ed3968058a47d6023b51f3cf2709 Mon Sep 17 00:00:00 2001 From: Anso Date: Wed, 10 Jun 2026 12:54:23 -0400 Subject: [PATCH] chore: raise dev auth rate limit so the full E2E suite is not blocked (#1353) The Playwright E2E suite logs in per test (fresh context each) and has grown past the 100-attempt/15-min dev cap on the auth limiter, so the last test in a run gets 'Too many attempts' and fails. Raise the non-production cap to 1000 to restore headroom for the suite and local tooling. Production stays at 5 attempts/15min, so brute-force protection is unchanged. --- backend/src/middleware/rateLimiters.ts | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/backend/src/middleware/rateLimiters.ts b/backend/src/middleware/rateLimiters.ts index a6b778ef..9e18f98c 100644 --- a/backend/src/middleware/rateLimiters.ts +++ b/backend/src/middleware/rateLimiters.ts @@ -162,10 +162,11 @@ export const webhookTriggerLimiter = rateLimit({ }); // Tier 3: Auth endpoint limiter. 15-minute window to blunt brute-force attacks. -// Prod: 5 attempts/15min/IP. Dev: 100 attempts so E2E tests and local tooling are not blocked. +// Prod: 5 attempts/15min/IP. Dev: 1000 attempts so the full E2E suite, which logs +// in per test and has outgrown a 100-attempt window, plus local tooling, are not blocked. export const authRateLimiter = rateLimit({ windowMs: 15 * 60 * 1000, - max: process.env.NODE_ENV === 'production' ? 5 : 100, + max: process.env.NODE_ENV === 'production' ? 5 : 1000, standardHeaders: true, legacyHeaders: false, message: { error: 'Too many attempts. Please try again in 15 minutes.' },