feat(security) ✨ implement API rate limiting with throttler #21

[Mattic77]

GitHub Issue

Closes GH-21

Description 📝

This PR implements API Rate Limiting across the entire backend using the @nestjs/throttler package. It provides a global safety layer and strict protection for sensitive endpoints to prevent brute-force attacks and spam.

Type of Change

• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security improvement

Changes

• Global Throttling: Configured a global limit of 100 requests per minute in AppModule.
• Auth Protection: Implemented strict limits for authentication routes:
  • POST /auth/signin: 10 attempts per minute.
  • POST /auth/signup: 5 attempts per minute.
  • POST /auth/signup-otp: 3 attempts per minute (Protects email/OTP costs).
• Spam Protection: Limited POST /friends/request/:id to 10 per minute to prevent harassment.
• Middleware Integration: Integrated ThrottlerGuard as a global APP_GUARD.

Headers 📡

The API will now return the following standard rate-limit headers:

• X-RateLimit-Limit: Maximum requests allowed in the window.
• X-RateLimit-Remaining: Remaining requests in the current window.
• X-RateLimit-Reset: Time (in seconds) until the window resets.

Screenshots 📷 (if applicable)

(No UI changes)

[Copilot]

Pull request overview

Implements API rate limiting across the NestJS backend using @nestjs/throttler, applying a global request cap and stricter per-route throttles for sensitive/spam-prone endpoints.

Changes:

• Added global throttling configuration (100 requests per minute) and registered ThrottlerGuard as a global APP_GUARD.
• Applied stricter @Throttle(...) limits to signup, signup-otp, and signin auth routes.
• Added a per-route throttle for POST /friends/request/:id to reduce request spam/harassment.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/app.module.ts	Adds ThrottlerModule global configuration and registers ThrottlerGuard as a global guard.
src/auth/auth.controller.ts	Adds route-level throttling for signup, OTP, and signin endpoints.
src/friend/friend.controller.ts	Adds route-level throttling for friend request creation endpoint.
package.json	Adds @nestjs/throttler dependency.
package-lock.json	Locks @nestjs/throttler dependency resolution/details.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.