Add rate limiting #43
Description
Description
The goal is to protect the API with rate limiting. Apply global limit (e.g. 100 req/min per IP) and stricter limits for auth routes (login, register: 5/min per IP). Use @nestjs/throttler or custom Redis-based limiter. Return 429 when limit exceeded.
Tasks
- Add throttler:
- Install @nestjs/throttler
- Configure global limit: 100 requests per 60 seconds per IP
- Configure auth routes: 5 requests per 60 seconds per IP for POST /auth/login, POST /auth/register
- Response:
- Return 429 with Retry-After header when limit exceeded
- Include clear error message
Additional Requirements
• Use Redis for distributed rate limiting if multiple instances (optional)
• Exclude health check from global limit
• Document rate limits in README or API docs
Acceptance Criteria
• Excessive requests return 429
• Auth routes have stricter limit
• Retry-After header present in 429 response