From deabe6ab3d09b9bc62685e47acc47f9d5ec36ae4 Mon Sep 17 00:00:00 2001
From: Keith Smith <keith@firebugit.com>
Date: Mon, 22 Dec 2025 22:36:54 -0700
Subject: [PATCH] Fix Critical Security Issue: Implement rate limiting on API
 endpoints
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Added comprehensive rate limiting to prevent abuse and DoS attacks:

Configuration (config/settings/base.py):
- Anon rate: 100 requests/hour for anonymous users
- User rate: 1000 requests/hour for authenticated users
- Login rate: 10 attempts/hour (prevents brute force)
- Register rate: 5 attempts/hour (prevents account spam)
- Sync rate: 100 requests/hour (prevents sync flooding)

Custom throttle classes (users/throttles.py):
- LoginRateThrottle: Strict limit for login endpoint
- RegisterRateThrottle: Strict limit for registration endpoint
- SyncRateThrottle: Moderate limit for sync endpoint

Applied throttling to sensitive endpoints:
- users.views.RegisterAPIView: 5/hour
- users.views.TokenObtainPairView: 10/hour
- sync.views.sync: 100/hour

All other API endpoints use default throttles (anon: 100/hour, user: 1000/hour).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 config/settings/base.py | 11 +++++++++++
 sync/views.py           |  4 +++-
 users/throttles.py      | 32 ++++++++++++++++++++++++++++++++
 users/views.py          |  3 +++
 4 files changed, 49 insertions(+), 1 deletion(-)
 create mode 100644 users/throttles.py

diff --git a/config/settings/base.py b/config/settings/base.py
index 278894c..99d1500 100644
--- a/config/settings/base.py
+++ b/config/settings/base.py
@@ -123,6 +123,17 @@ REST_FRAMEWORK = {
     ],
     'DEFAULT_PAGINATION_CLASS': 'rest_framework.pagination.PageNumberPagination',
     'PAGE_SIZE': 50,
+    'DEFAULT_THROTTLE_CLASSES': [
+        'rest_framework.throttling.AnonRateThrottle',
+        'rest_framework.throttling.UserRateThrottle',
+    ],
+    'DEFAULT_THROTTLE_RATES': {
+        'anon': '100/hour',  # Anonymous users: 100 requests per hour
+        'user': '1000/hour',  # Authenticated users: 1000 requests per hour
+        'login': '10/hour',  # Login attempts: 10 per hour
+        'register': '5/hour',  # Registration attempts: 5 per hour
+        'sync': '100/hour',  # Sync endpoint: 100 per hour
+    },
 }
 
 # JWT Settings
diff --git a/sync/views.py b/sync/views.py
index c466c7e..28b0dc4 100644
--- a/sync/views.py
+++ b/sync/views.py
@@ -10,7 +10,7 @@ from datetime import datetime
 from django.utils import timezone
 from django.utils.dateparse import parse_datetime
 from rest_framework import status
-from rest_framework.decorators import api_view, permission_classes
+from rest_framework.decorators import api_view, permission_classes, throttle_classes
 from rest_framework.permissions import IsAuthenticated
 from rest_framework.response import Response
 
@@ -25,12 +25,14 @@ from tasks.serializers import (
 )
 from .models import SyncLog, SyncConflict
 from .serializers import SyncConflictSerializer
+from users.throttles import SyncRateThrottle
 
 logger = logging.getLogger(__name__)
 
 
 @api_view(['POST'])
 @permission_classes([IsAuthenticated])
+@throttle_classes([SyncRateThrottle])
 def sync(request):
     """
     Main sync endpoint.
diff --git a/users/throttles.py b/users/throttles.py
new file mode 100644
index 0000000..15ec0c9
--- /dev/null
+++ b/users/throttles.py
@@ -0,0 +1,32 @@
+"""
+Custom throttle classes for user-related endpoints.
+"""
+
+from rest_framework.throttling import AnonRateThrottle, UserRateThrottle
+
+
+class LoginRateThrottle(AnonRateThrottle):
+    """
+    Rate limit for login attempts.
+
+    Stricter than general anonymous rate to prevent brute force attacks.
+    """
+    scope = 'login'
+
+
+class RegisterRateThrottle(AnonRateThrottle):
+    """
+    Rate limit for registration attempts.
+
+    Prevents automated account creation and abuse.
+    """
+    scope = 'register'
+
+
+class SyncRateThrottle(UserRateThrottle):
+    """
+    Rate limit for sync endpoint.
+
+    Prevents excessive sync requests that could overload the server.
+    """
+    scope = 'sync'
diff --git a/users/views.py b/users/views.py
index 8295c20..c08da1b 100644
--- a/users/views.py
+++ b/users/views.py
@@ -21,6 +21,7 @@ from .serializers import (
     DeviceTokenSerializer,
 )
 from .models import DeviceToken, EmailVerificationToken
+from .throttles import LoginRateThrottle, RegisterRateThrottle
 
 User = get_user_model()
 
@@ -35,6 +36,7 @@ class RegisterAPIView(generics.CreateAPIView):
     queryset = User.objects.all()
     serializer_class = UserRegistrationSerializer
     permission_classes = [permissions.AllowAny]
+    throttle_classes = [RegisterRateThrottle]
 
     def create(self, request, *args, **kwargs):
         serializer = self.get_serializer(data=request.data)
@@ -225,6 +227,7 @@ class TokenObtainPairView(BaseTokenObtainPairView):
     """Custom JWT token view using our custom serializer."""
 
     serializer_class = CustomTokenObtainPairSerializer
+    throttle_classes = [LoginRateThrottle]
 
 
 # =============================================================================