services/backend's POST /auth/challenge endpoint currently has no rate limiting — it's a public, unauthenticated endpoint that inserts a row into auth_nonces and builds a challenge transaction on every call. Same for POST /auth/verify. Neither has abuse protection against someone hammering the endpoint to fill the table or brute-force nonce/signature attempts.
To do: add rate limiting (e.g. tower-http's GovernorLayer or a simple per-IP token bucket) to both auth endpoints, and consider a cleanup job/TTL index for expired auth_nonces rows.
services/backend'sPOST /auth/challengeendpoint currently has no rate limiting — it's a public, unauthenticated endpoint that inserts a row intoauth_noncesand builds a challenge transaction on every call. Same forPOST /auth/verify. Neither has abuse protection against someone hammering the endpoint to fill the table or brute-force nonce/signature attempts.To do: add rate limiting (e.g.
tower-http'sGovernorLayeror a simple per-IP token bucket) to both auth endpoints, and consider a cleanup job/TTL index for expiredauth_noncesrows.