Request Rate Limiting Middleware for API Protection

[phertyameen]

Labels: middleware, security, performance, high-priority

Description:

Implement intelligent rate limiting middleware to protect the API from abuse, DDoS attacks, and excessive requests from single sources.

Requirements:

Limit requests per IP address within time windows (e.g., 100 requests per 15 minutes)
Support different rate limits for different endpoint types:

• Strict limits for authentication endpoints (5 login attempts per 15 min)

• Moderate limits for puzzle submission (30 per hour)

• Generous limits for read-only endpoints (300 per hour)

• Special limits for admin endpoints (1000 per hour)

• Use Redis for distributed rate limit tracking across server instances

• Return 429 Too Many Requests with retry-after header

• Support rate limit exemptions for whitelisted IPs (admin access)

• Track rate limits by user ID for authenticated requests (more accurate)

• Provide rate limit info in response headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset)

• Support burst allowance for temporary spikes

• Log rate limit violations for security monitoring

Acceptance Criteria:

• Rate limits enforced across all specified endpoint types
• Redis used for distributed state management
• 429 status code returned when limit exceeded
• Retry-After header indicates when user can retry
• Response headers show current rate limit status
• Authenticated users tracked by userId, not IP (more accurate)
• Whitelisted IPs bypass rate limiting
• Rate limit configuration easily adjustable via environment variables
• No legitimate users blocked under normal usage patterns
• System handles edge cases (Redis connection failure, clock skew)

Rate Limit Tiers:

• Authentication routes: 5 requests / 15 minutes
• Puzzle submission: 30 requests / hour per user
• Daily quest generation: 2 requests / day per user
• Read-only endpoints: 300 requests / hour
• Admin endpoints: 1000 requests / hour
• Public landing page: 1000 requests / hour

Headers to Include:

• X-RateLimit-Limit: Maximum requests allowed
• X-RateLimit-Remaining: Requests remaining in window
• X-RateLimit-Reset: Timestamp when limit resets
• Retry-After: Seconds until user can retry (when limited)

NOTE: ALL SHOULD BE IMPLEMENTED IN THE MIDDLEWARE FOLDER/REPO

[zainabb-dev]

@zainabb-dev has applied to work on this issue as part of the Stellar Wave Program's 3rd wave.

Gm Gm Maintainer!
I would like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @zainabb-dev to this issue.

[drips-wave]

Congratulations, @zainabb-dev! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on March 30, 2026.

🧑‍💻 @zainabb-dev: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊