security update

lib/api/routes/loginRoute.js

@@ -9,6 +9,27 @@ import * as hasher from '../../services/security/hash.js';
 import { trackDemoAccessed } from '../../services/tracking/Tracker.js';
 import logger from '../../services/logger.js';
 import { getSettings } from '../../services/storage/settingsStorage.js';
+
+const MAX_LOGIN_ATTEMPTS = 10;
+const LOGIN_WINDOW_MS = 15 * 60 * 1000; // 15 minutes
+const loginAttempts = new Map(); // ip -> { count, firstAttempt }
+
+function getClientIp(req) {
+  const forwarded = req.headers['x-forwarded-for'];
+  return (forwarded ? forwarded.split(',')[0] : req.socket?.remoteAddress) || 'unknown';
+}
+
+function isRateLimited(ip) {
+  const now = Date.now();
+  const record = loginAttempts.get(ip);
+  if (!record || now - record.firstAttempt > LOGIN_WINDOW_MS) {
+    loginAttempts.set(ip, { count: 1, firstAttempt: now });
+    return false;
+  }
+  record.count++;
+  return record.count > MAX_LOGIN_ATTEMPTS;
+}
+
 const service = restana();
 const loginRouter = service.newRouter();
 loginRouter.get('/user', async (req, res) => {
@@ -25,6 +46,12 @@ loginRouter.get('/user', async (req, res) => {
   res.send();
 });
 loginRouter.post('/', async (req, res) => {
+  const ip = getClientIp(req);
+  if (isRateLimited(ip)) {
+    logger.error(`Login rate limit exceeded for IP ${ip}`);
+    res.send(429);
+    return;
+  }
   const settings = await getSettings();
   const { username, password } = req.body;
   const user = userStorage.getUsers(true).find((user) => user.username === username);
@@ -38,6 +65,8 @@ loginRouter.post('/', async (req, res) => {
     }
 
     req.session.currentUser = user.id;
+    req.session.createdAt = Date.now();
+    loginAttempts.delete(ip);
     userStorage.setLastLoginToNow({ userId: user.id });
     res.send(200);
     return;