security(auth): one rate-limit bucket for all auth routes locks users out, login timing reveals registered addresses, no per-account throttle

[alex-dembele]

Problem

The authentication throttle protects the wrong thing, in the wrong way.

• Real users get locked out: someone typing a password on the sign-up screen can lock themselves out of signing up and signing in.
• Real attackers are barely slowed: someone trying passwords against one account from many IPs is not slowed at all.
• Login leaks which addresses have an account: the error message is identical, but the response time is not.

Reproduced (2026-09-15, local API against a fresh database)

1. One bucket for every auth route.

• RateLimit keys on c.IP() alone (backend/internal/middleware/ratelimit.go).
• The same Redis store (authLimiterStore, backend/cmd/server/main.go) serves /auth/login, /auth/register, /auth/password/forgot, /auth/password/reset and /auth/password/check, at 15 requests per 5 minutes.
• The sign-up screen calls /auth/password/check (debounced) while the user types.

16 × POST /auth/password/check → 200 ×15, then 429
POST /auth/login    (valid credentials) → 429 {"error":true,"msg":"Rate limit exceeded"}
POST /auth/register (new address)       → 429

• The screen hides it: AuthScreen.tsx maps any status other than 409/400 to the generic "registration failed", so the user is not told to wait.
• Shared networks: behind an office NAT, the whole office shares those 15 requests.

2. Login timing reveals registered addresses. Wrong password, 4 attempts each:

unknown address : 401 in 5.8–7.1 ms
existing address: 401 in 38–58 ms

• LoginUseCase.Execute returns before hashing when the address is unknown or the account is disabled, and runs bcrypt otherwise.
• The body is the same {"error":"Authentication failed"} in both cases; the clock is the oracle.

3. No per-account protection. There is no failed-attempt counter, lockout or backoff anywhere in backend/internal or backend/pkg. Password guessing against one account is limited only per source IP.

4. Login is case-sensitive on the address. GormUserRepository.GetByEmail uses email = ?, while password reset normalises the address. With the registration defect in #687, Awa.Diallo@E2E.test and awa.diallo@e2e.test are two different accounts at login.

Acceptance criteria

1. Separate buckets per purpose: /auth/password/check never consumes the login or sign-up budget. Login, sign-up and password reset each have their own key, prefixed by purpose. The existing PrefixedRateLimitBackend pattern is acceptable.
2. Readable throttle answers: a throttled auth call answers 429 with Retry-After and a JSON code. The sign-in and sign-up screens tell the user how long to wait, in FR and EN.
3. Per-account backoff: failed logins for one normalised address are limited across all source IPs. After N failures in a window, further attempts for that address are delayed or refused for a bounded time.
   • The limit must not let an attacker lock the real owner out indefinitely: bounded delay, and a successful password reset clears it.
   • Every failure is audited with the address hashed.
4. Constant work at login: a login for an unknown or disabled address performs a password-hash comparison of the same cost as for a real account.
   • The test: for unknown and existing addresses, the median response times over 20 attempts differ by less than 10 ms, measured the same way as above.
5. Case-insensitive login: the address is looked up normalised (domain.NormaliseEmail).
6. Tests:
   • TestLogin_UnknownAddressCostsAHashComparison
   • TestLogin_EmailCaseInsensitive
   • TestAuthRateLimit_PasswordCheckDoesNotConsumeLoginBudget
   • TestLogin_PerAccountBackoff
   • a frontend test for the 429 message.

Related: #686 (duplicate-address sign-up) and #687 (registration defects).

Definition of Done

• go build ./... && go vet ./... && go test ./... -race green, npm run build && npx vitest run green, with output pasted here.
• Reproductions 1, 2 and 4 re-run after the fix, with output pasted here.
• Progress comment in the CLAUDE.md format; PR with Closes this issue.

[alex-dembele]

claude — 2026-10-02

Done — branch 688-auth-throttle, stacked on #689 (PR #871), because it reuses #689's attempt store. Spec: docs/688_AUTH_THROTTLE.md (approved by the owner today: thresholds as written, GetByEmail itself made case-insensitive).

• backend/internal/middleware/ratelimit.go: every 429 now carries Retry-After plus code: RATE_LIMITED and retry_after in the body. error and msg are unchanged.
• backend/internal/middleware/auth_limits.go (new): NewAuthLimiters builds one bucket per purpose (per IP): login 15/5min, register 10/15min, forgot+reset 15/5min, password/check 120/5min, re-auth (password change, MFA disable) 15/5min. PrefixedBackend moved here; handler.PrefixedRateLimitBackend is now an alias. Wired in cmd/server/main.go.
• backend/internal/infrastructure/repository/gorm_user_repository.go: GetByEmail matches on LOWER(email). If legacy case-variant rows exist, the exact spelling wins, then the oldest row.
• backend/internal/application/auth/login.go: the address is normalised before lookup. An unknown address is compared against a dummy hash made at start-up; a disabled account is compared against its real hash.
• backend/internal/application/auth/login_limits.go (new): 10 failures per hashed address in 15 min → 15-min lock. Refused attempts don't extend it, a success clears the count, and ConfirmPasswordResetUseCase.WithLoginLockClearer ends the lock. Uses authmfa.AttemptStore from security(auth): MFA challenge codes can be guessed without limit — no attempt counter, no rate limit #689.
• backend/internal/handler/auth/handler.go: LoginLockedError → 429 LOGIN_LOCKED + Retry-After. Every failed sign-in is audited with email_sha256=<hex>.
• frontend/src/features/auth/AuthScreen.tsx, authStrings.ts: any 429 on sign-in or sign-up shows how long to wait (FR/EN).

Verified
Backend gate (cd backend && go build ./... && go vet ./... && go test ./... -race): BUILD_OK · VET_OK · TEST_OK, 80 packages ok, 0 FAIL.

Frontend gate: npx tsc -b --noEmit exit 0 · npx vitest run → 102 files, 950 tests passed · npm run build → built in 4.97s · eslint src/features/auth → 2 errors, both already on master, in MFAEnrollmentBanner.tsx:61 and MFAPostAhaPrompt.tsx:64, neither touched here. The 6 new tests in authThrottle.test.tsx fail with the old AuthScreen.tsx and pass with the new one.

Named tests: TestLogin_UnknownAddressCostsAHashComparison, TestLogin_EmailCaseInsensitive, TestAuthRateLimit_PasswordCheckDoesNotConsumeLoginBudget, TestLogin_PerAccountBackoff, plus TestLogin_Success/_NotFound/_Unauthorized, TestConfirmPasswordReset_ClearsLoginLock, TestGetByEmail_CaseInsensitive, TestGetByEmail_LegacyMixedCaseRows, TestLoginThrottle_LockedAddressAnswers429AndEveryFailureIsAudited, TestRateLimit_RefusalCarriesRetryAfterAndCode.

Live (throwaway Postgres 18 + Redis, branch server, 2026-10-02):

Reproduction 1, run again:

121 × POST /auth/password/check → 120 × 200, then 429
122nd: HTTP 429 · Retry-After: 282 · {"code":"RATE_LIMITED","error":true,"msg":"Rate limit exceeded","retry_after":282}
POST /auth/login (valid)    → 200
POST /auth/register (new)   → 201

Reproduction 2, run again (20 attempts each, wrong password, one source IP per request):

unknown  n=20 codes=['401'] median=44.6 ms  min=37.5  max=54.5
existing n=20 codes=['401'] median=46.6 ms  min=37.7  max=53.3
difference of medians = 2.0 ms (criterion: < 10 ms)

Reproduction 4, run again (account registered as awa.diallo@e2e.test):

'Awa.Diallo@E2E.test'   → HTTP 200 user.email= awa.diallo@e2e.test
'AWA.DIALLO@E2E.TEST'   → HTTP 200 user.email= awa.diallo@e2e.test
' awa.diallo@e2e.test ' → HTTP 200 user.email= awa.diallo@e2e.test

Per-address backoff (criterion 3):

10 wrong passwords, alternating 127.0.0.70 / .71 → 10 × 401
11th, RIGHT password, from 127.0.0.80 → 429 · Retry-After: 900 · {"code":"LOGIN_LOCKED",...,"retry_after":900}
redis: mfa-attempts:login:lock:ed0afddf… ttl=900s
audit: 5 × .50 / 5 × .51 "authentication failed email_sha256=ed0afddf…", 1 × "login_locked email_sha256=ed0afddf…"  (= sha256("awa.diallo@e2e.test"); the address never appears in clear)
forgot → 200 · mailed link → reset → 200 · lock keys after reset: 0 · login with new password → 200

Browser (Vite against the branch server): sign-in on the locked address shows "Trop de tentatives. Réessayez dans 15 minutes."; sign-up in EN with the IP's sign-up budget used up shows "Too many attempts. Try again in 7 minutes."

Criteria — 1 ✅ · 2 ✅ · 3 ✅ · 4 ✅ (2.0 ms) · 5 ✅ · 6 ✅

Next — owner reviews the PR. Merge #871 first; GitHub then retargets this PR to master. Possible follow-ups (not opened): a lower(email) index once migration numbering is free; AuditService.LogFiber takes the audit IP from raw X-Forwarded-For (pre-existing, spoofable).

Blocked on — #871 merging (stacked base)

[alex-dembele]

Heads-up for whoever picks this up: 688-auth-throttle sits on the old #689 commits. Those included a stray #870 commit (4f544415) from the shared working tree.

#689 now lives on 689-mfa-challenge-limits (PR #875), without that commit. To restack this branch on it:

git fetch origin
git rebase --onto origin/689-mfa-challenge-limits fff5eace 688-auth-throttle

After that, git log origin/689-mfa-challenge-limits..688-auth-throttle should list only the four #688 commits.