fix(rate-limiting): refactor with tiered approach for finance apps

- Previous config was too strict (only 10 auth requests per 15 min)
- New global limit: 120 requests per minute (handles sync bursts)
- Auth-specific limiters per endpoint:
  - Login/Register: 15 failed attempts/15min (bruteforce protection)
  - Token Refresh: 20 requests/min (mobile background sync friendly)
  - Password Change: 5 attempts/hour
  - Account Deletion: 3 attempts/24h
- Transaction/Recurring routes: 60 writes per minute
- Token refresh now separate from login
- Successful requests skipped for login/register
- Using standardHeaders: draft-7 for modern headers

Bump version to 0.8.3

Author: IT-BAER

CHANGELOG.md

@@ -2,6 +2,23 @@
 
 All notable changes to this project are documented in this file.
 
+## [v0.8.3] - 2026-01-08
+
+### fix
+
+- **Rate Limiting**: Refactored rate limiting with tiered approach for finance apps
+  - Previous config was too strict (only 10 auth requests per 15 min including token refresh!)
+  - New global limit: 120 requests per minute (handles sync bursts)
+  - Auth-specific limiters per endpoint:
+    - Login/Register: 15 failed attempts per 15 min (bruteforce protection)
+    - Token Refresh: 20 requests per minute (mobile background sync friendly)
+    - Password Change: 5 attempts per hour
+    - Account Deletion: 3 attempts per 24 hours
+  - Transaction/Recurring routes: 60 writes per minute
+  - Token refresh now separate from login - won't block legitimate refresh calls
+  - Successful requests skipped for login/register (won't lock out legitimate users)
+  - Using `standardHeaders: "draft-7"` for modern rate limit headers
+
 ## [v0.8.2] - 2026-01-08
 
 ### fix

package.json

@@ -1,6 +1,6 @@
 {
   "name": "finx",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "description": "A modern personal finance management application",
   "main": "server.js",
   "scripts": {

routes/auth.js

@@ -1,4 +1,5 @@
 const express = require("express");
+const rateLimit = require("express-rate-limit");
 const {
   register,
   login,
@@ -20,20 +21,68 @@ const {
 
 const router = express.Router();
 
+// ============================================================================
+// Auth-specific rate limiters
+// ============================================================================
+
+// Login/Register limiter - bruteforce protection
+// Only counts failed requests to prevent lockout of legitimate users
+const loginLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  limit: 15, // 15 failed attempts per 15 min (1 per minute average)
+  standardHeaders: "draft-7",
+  legacyHeaders: false,
+  skipSuccessfulRequests: true,
+  message: { error: "Too many authentication attempts. Please try again in 15 minutes." },
+});
+
+// Token refresh limiter - more generous for mobile app background sync
+// Token refresh is automatic and essential for app functionality
+const refreshLimiter = rateLimit({
+  windowMs: 1 * 60 * 1000, // 1 minute
+  limit: 20, // 20 refreshes per minute (handles multiple devices, retries, background sync)
+  standardHeaders: "draft-7",
+  legacyHeaders: false,
+  message: { error: "Too many token refresh requests. Please wait before retrying." },
+});
+
+// Password change limiter - strict to prevent abuse
+const passwordChangeLimiter = rateLimit({
+  windowMs: 60 * 60 * 1000, // 1 hour
+  limit: 5, // 5 attempts per hour
+  standardHeaders: "draft-7",
+  legacyHeaders: false,
+  skipSuccessfulRequests: true,
+  message: { error: "Too many password change attempts. Please try again in an hour." },
+});
+
+// Account deletion limiter - very strict
+const deletionLimiter = rateLimit({
+  windowMs: 24 * 60 * 60 * 1000, // 24 hours
+  limit: 3, // 3 attempts per day
+  standardHeaders: "draft-7",
+  legacyHeaders: false,
+  message: { error: "Too many account deletion attempts. Please try again tomorrow." },
+});
+
+// ============================================================================
+// Routes
+// ============================================================================
+
 // Register route - only enable if DISABLE_REGISTRATION is not set to true
 if (process.env.DISABLE_REGISTRATION !== "true") {
-  router.post("/register", validateBody(registerSchema), register);
+  router.post("/register", loginLimiter, validateBody(registerSchema), register);
 } else {
   router.post("/register", (req, res) => {
     res.status(403).json({ message: "Registration is disabled" });
   });
 }
 
 // Login route
-router.post("/login", validateBody(loginSchema), login);
+router.post("/login", loginLimiter, validateBody(loginSchema), login);
 
 // Refresh token route (no auth middleware - uses refresh token for authentication)
-router.post("/refresh", refreshToken);
+router.post("/refresh", refreshLimiter, refreshToken);
 
 // Logout route (protected - needs valid access token or refresh token)
 router.post("/logout", auth, logout);
@@ -45,10 +94,10 @@ router.get("/me", auth, getCurrentUser);
 router.put("/me", auth, validateBody(updateProfileSchema), updateUser);
 
 // Change password (protected route)
-router.post("/change-password", auth, validateBody(changePasswordSchema), changePassword);
+router.post("/change-password", auth, passwordChangeLimiter, validateBody(changePasswordSchema), changePassword);
 
 // Delete account (protected route)
-router.delete("/me", auth, deleteAccount);
+router.delete("/me", auth, deletionLimiter, deleteAccount);
 
 module.exports = router;
 

server.js

@@ -88,23 +88,33 @@ app.use(
   }),
 );
 
-// General rate limiting
+// ============================================================================
+// Rate Limiting Configuration
+// Tiered approach for personal finance app with mobile sync support
+// Auth-specific limiters are defined in routes/auth.js per-endpoint
+// ============================================================================
+
+// General API limiter - generous for data sync operations
+// Finance apps may fetch transactions, categories, sources, targets, goals, etc.
 const generalLimiter = rateLimit({
-  windowMs: 15 * 60 * 1000,
-  max: 1000,
-  standardHeaders: true,
+  windowMs: 1 * 60 * 1000, // 1 minute window
+  limit: 120, // 120 requests per minute (2 req/sec sustained)
+  standardHeaders: "draft-7",
   legacyHeaders: false,
+  message: { error: "Too many requests. Please wait a moment before trying again." },
 });
 
-// Strict rate limiting
-const strictLimiter = rateLimit({
-  windowMs: 15 * 60 * 1000,
-  max: 10,
-  standardHeaders: true,
+// Transaction/write limiter - slightly stricter for write operations
+// Prevents accidental or malicious flooding of transaction/recurring creation
+const transactionWriteLimiter = rateLimit({
+  windowMs: 1 * 60 * 1000, // 1 minute window
+  limit: 60, // 60 writes per minute (1 per second sustained)
+  standardHeaders: "draft-7",
   legacyHeaders: false,
-  skipSuccessfulRequests: true,
+  message: { error: "Too many write operations. Please slow down." },
 });
 
+// Apply general limiter to all routes
 app.use(generalLimiter);
 
 // Routes
@@ -128,10 +138,12 @@ app.get("/ready", async (req, res) => {
 });
 
 // API Routes
-app.use("/api/auth", strictLimiter, require("./routes/auth"));
+// Auth routes need separate handling - some endpoints are sensitive, others less so
+const authRouter = require("./routes/auth");
+app.use("/api/auth", authRouter);
 app.use("/api/categories", require("./routes/category"));
-app.use("/api/transactions", require("./routes/transaction"));
-app.use("/api/recurring-transactions", require("./routes/recurring-transactions"));
+app.use("/api/transactions", transactionWriteLimiter, require("./routes/transaction"));
+app.use("/api/recurring-transactions", transactionWriteLimiter, require("./routes/recurring-transactions"));
 app.use("/api/sources", require("./routes/source"));
 app.use("/api/targets", require("./routes/target"));
 app.use("/api/sharing", require("./routes/sharing"));