feat: add server-side rate limiting for API endpoints (#1425)

[jayshreerathoreai32-hue]

Resolves #1425

Description

This PR implements server-side rate limiting for the Express backend using express-rate-limit to protect API endpoints from abuse, brute-force attacks, excessive automated traffic, and repeated requests.

The implementation introduces configurable rate limiters through environment variables and applies them at both the global API level and to sensitive authentication endpoints. Integration tests have also been added to verify that request limits are enforced correctly and that clients receive the expected 429 Too Many Requests response when the limit is exceeded.

Changes Included

1. Rate Limiter Middleware Refactor

• Updated rateLimiter.js to use express-rate-limit for request throttling.
• Refactored the existing middleware to support environment-variable based configuration.
• Fixed the previously unresolved syntax error in the rate limiter implementation.
• Added reusable limiter configurations so different API areas can have different request limits.

2. Global API Rate Limiting

• Added a generalLimiter for general API protection.
• Applied the limiter globally across /api/* endpoints.
• Default configuration:
  • 100 requests
  • 15-minute window
• Helps prevent excessive automated traffic and protects backend resources from accidental or malicious request floods.

3. Authentication Rate Limiting

• Retained a stricter authLimiter for sensitive authentication routes such as:
  • Login
  • Registration
• Default configuration:
  • 10 requests
  • 15-minute window
• Provides additional protection against brute-force attempts and repeated authentication requests.

4. Environment-Based Configuration

• Added rate limiting configuration variables to .env.example.
• Allows deployment environments to customize request limits without modifying application source code.
• Keeps rate limiting behavior flexible for development, testing, and production environments.

5. Automated Integration Tests

• Added server/tests/rateLimiter.test.js.
• Tests verify:
  • Requests are allowed while within the configured limit.
  • Requests are blocked after the limit is exceeded.
  • The server returns the correct HTTP status: 429 Too Many Requests.
  • Rate limiting middleware is correctly applied to the relevant endpoints.

Security & Reliability Improvements

This change adds an additional layer of protection to the backend by limiting how frequently clients can interact with API endpoints.

It helps reduce the impact of:

• Brute-force authentication attempts
• API abuse
• Excessive automated requests
• Accidental request loops
• Resource exhaustion caused by high request volumes

The stricter authentication limiter provides targeted protection for endpoints where repeated requests can pose a greater security risk.

How to Test

1. Clone or checkout this branch.

2. Start the backend server:

   npm run dev

[vercel]

@jayshreerathoreai32-hue is attempting to deploy a commit to the jiya's projects Team on Vercel.

A member of the Team first needs to authorize it.

[netlify]

✅ Deploy Preview for codevibeforyou ready!

Name	Link
🔨 Latest commit	98dbdc2
🔍 Latest deploy log	https://app.netlify.com/projects/codevibeforyou/deploys/6a7ccf9705429500081c191b
😎 Deploy Preview	https://deploy-preview-1466--codevibeforyou.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.