fix: add rate limiting for sign up, password reset, and log in (#7281)

Author: n1ru4l

.changeset/every-chefs-switch.md

@@ -0,0 +1,8 @@
+---
+'hive': minor
+---
+
+Introduce rate limiting for email sign up, sign in and password rest.
+The IP value to use for the rate limiting can be specified via the
+`SUPERTOKENS_RATE_LIMIT_IP_HEADER_NAME` environment variable.
+By default the `CF-Connecting-IP` header is being used.

packages/services/server/README.md

@@ -48,6 +48,7 @@ The GraphQL API for GraphQL Hive.
 | `CDN_API_KV_BASE_URL`                       | No (**Optional** if `CDN_API` is set to `1`)         | The base URL for the KV for API Provider. Used for scenarios where we cache CDN access.                  | `https://key-cache.graphql-hive.com`                 |
 | `SUPERTOKENS_CONNECTION_URI`                | **Yes**                                              | The URI of the SuperTokens instance.                                                                     | `http://127.0.0.1:3567`                              |
 | `SUPERTOKENS_API_KEY`                       | **Yes**                                              | The API KEY of the SuperTokens instance.                                                                 | `iliketurtlesandicannotlie`                          |
+| `SUPERTOKENS_RATE_LIMIT_IP_HEADER_NAME`     | No (Default value: `CF-Connecting-IP`)               | Name of the header to be used for rate limiting.                                                         | `CF-Connecting-IP`                                   |
 | `AUTH_GITHUB`                               | No                                                   | Whether login via GitHub should be allowed                                                               | `1` (enabled) or `0` (disabled)                      |
 | `AUTH_GITHUB_CLIENT_ID`                     | No (**Yes** if `AUTH_GITHUB` is set)                 | The GitHub client ID.                                                                                    | `g6aff8102efda5e1d12e`                               |
 | `AUTH_GITHUB_CLIENT_SECRET`                 | No (**Yes** if `AUTH_GITHUB` is set)                 | The GitHub client secret.                                                                                | `g12e552xx54xx2b127821dc4abc4491dxxxa6b187`          |

packages/services/server/src/environment.ts

@@ -98,6 +98,7 @@ const RedisModel = zod.object({
 const SuperTokensModel = zod.object({
   SUPERTOKENS_CONNECTION_URI: zod.string().url(),
   SUPERTOKENS_API_KEY: zod.string(),
+  SUPERTOKENS_RATE_LIMIT_IP_HEADER_NAME: emptyString(zod.string().optional()),
 });
 
 const GitHubModel = zod.union([
@@ -408,6 +409,7 @@ export const env = {
   supertokens: {
     connectionURI: supertokens.SUPERTOKENS_CONNECTION_URI,
     apiKey: supertokens.SUPERTOKENS_API_KEY,
+    rateLimitIPHeaderName: supertokens.SUPERTOKENS_RATE_LIMIT_IP_HEADER_NAME ?? 'CF-Connecting-IP',
   },
   auth: {
     github:

packages/services/server/src/index.ts

@@ -497,6 +497,7 @@ export async function main() {
       storage,
       crypto,
       logger: server.log,
+      redis,
       broadcastLog(id, message) {
         pubSub.publish('oidcIntegrationLogs', id, {
           timestamp: new Date().toISOString(),

packages/services/server/src/supertokens.ts

@@ -1,4 +1,5 @@
 import type { FastifyBaseLogger } from 'fastify';
+import type Redis from 'ioredis';
 import { CryptoProvider } from 'packages/services/api/src/modules/shared/providers/crypto';
 import { OverrideableBuilder } from 'supertokens-js-override/lib/build/index.js';
 import supertokens from 'supertokens-node';
@@ -16,6 +17,7 @@ import { createInternalApiCaller } from './api';
 import { env } from './environment';
 import {
   createOIDCSuperTokensProvider,
+  getLoggerFromUserContext,
   getOIDCSuperTokensOverrides,
   type BroadcastOIDCIntegrationLog,
 } from './supertokens/oidc-provider';
@@ -34,6 +36,7 @@ export const backendConfig = (requirements: {
   crypto: CryptoProvider;
   logger: FastifyBaseLogger;
   broadcastLog: BroadcastOIDCIntegrationLog;
+  redis: Redis;
 }): TypeInput => {
   const { logger } = requirements;
   const emailsService = createTRPCProxyClient<EmailsApi>({
@@ -146,7 +149,7 @@ export const backendConfig = (requirements: {
           }),
         },
         override: composeSuperTokensOverrides([
-          getEnsureUserOverrides(internalApi),
+          getEnsureUserOverrides(internalApi, requirements.redis),
           env.auth.organizationOIDC ? getOIDCSuperTokensOverrides() : null,
         ]),
       }),
@@ -208,8 +211,33 @@ export const backendConfig = (requirements: {
   };
 };
 
+function extractIPFromUserContext(userContext: unknown): string {
+  return (
+    (userContext as any)._default.request.getHeaderValue(env.supertokens.rateLimitIPHeaderName) ||
+    (userContext as any)._default.request.original.ip
+  );
+}
+
+function createRedisRateLimiter(redis: Redis, windowSeconds = 5 * 60, maxRequests = 10) {
+  async function isRateLimited(action: string, ip: string): Promise<boolean> {
+    const key = `supertokens-rate-limit:${action}:${ip}`;
+    const current = await redis.incr(key);
+    if (current === 1) {
+      await redis.expire(key, windowSeconds);
+    }
+    if (current > maxRequests) {
+      return true;
+    }
+
+    return false;
+  }
+
+  return { isRateLimited };
+}
+
 const getEnsureUserOverrides = (
   internalApi: ReturnType<typeof createInternalApiCaller>,
+  redis: Redis,
 ): ThirdPartEmailPasswordTypeInput['override'] => ({
   apis: originalImplementation => ({
     ...originalImplementation,
@@ -218,6 +246,18 @@ const getEnsureUserOverrides = (
         throw Error('emailPasswordSignUpPOST is not available');
       }
 
+      const logger = getLoggerFromUserContext(input.userContext);
+      const ip = extractIPFromUserContext(input.userContext);
+      const rateLimiter = createRedisRateLimiter(redis);
+
+      if (await rateLimiter.isRateLimited('sign-up', ip)) {
+        logger.debug('email password sign up rate limited (ip=%s)', ip);
+        return {
+          status: 'GENERAL_ERROR',
+          message: 'Please try again in a few minutes.',
+        };
+      }
+
       const response = await originalImplementation.emailPasswordSignUpPOST(input);
 
       const firstName = input.formFields.find(field => field.id === 'firstName')?.value ?? null;
@@ -240,6 +280,18 @@ const getEnsureUserOverrides = (
         throw Error('Should never come here');
       }
 
+      const logger = getLoggerFromUserContext(input.userContext);
+      const ip = extractIPFromUserContext(input.userContext);
+      const rateLimiter = createRedisRateLimiter(redis);
+
+      if (await rateLimiter.isRateLimited('sign-in', ip)) {
+        logger.debug('email sign in rate limited (ip=%s)', ip);
+        return {
+          status: 'GENERAL_ERROR',
+          message: 'Please try again in a few minutes.',
+        };
+      }
+
       const response = await originalImplementation.emailPasswordSignInPOST(input);
 
       if (response.status === 'OK') {
@@ -285,6 +337,18 @@ const getEnsureUserOverrides = (
       return response;
     },
     async passwordResetPOST(input) {
+      const logger = getLoggerFromUserContext(input.userContext);
+      const ip = extractIPFromUserContext(input.userContext);
+      const rateLimiter = createRedisRateLimiter(redis);
+
+      if (await rateLimiter.isRateLimited('password-reset', ip)) {
+        logger.debug('password reset rate limited (ip=%s)', ip);
+        return {
+          status: 'GENERAL_ERROR',
+          message: 'Please try again in a few minutes.',
+        };
+      }
+
       const result = await originalImplementation.passwordResetPOST!(input);
 
       // For security reasons we revoke all sessions when a password reset is performed.
@@ -349,6 +413,7 @@ export function initSupertokens(requirements: {
   crypto: CryptoProvider;
   logger: FastifyBaseLogger;
   broadcastLog: BroadcastOIDCIntegrationLog;
+  redis: Redis;
 }) {
   supertokens.init(backendConfig(requirements));
 }

packages/services/server/src/supertokens/oidc-provider.ts

@@ -29,7 +29,7 @@ export const getOIDCSuperTokensOverrides = (): ThirdPartEmailPasswordTypeInput['
 
 export type BroadcastOIDCIntegrationLog = (oidcId: string, message: string) => void;
 
-function getLoggerFromUserContext(userContext: unknown): FastifyBaseLogger {
+export function getLoggerFromUserContext(userContext: unknown): FastifyBaseLogger {
   return (userContext as any)._default.request.request.log;
 }