Internal
Public Access
Keith SmithandClaude Sonnet 4.5
a03b9fe79c
Added rate limiting to previously unprotected user-related endpoints. Protected Endpoints: - UserProfileAPIView: Profile retrieval and updates (1000 req/hour) - ChangePasswordAPIView: Password change operations (1000 req/hour) - DeviceTokenAPIView: Device token registration (1000 req/hour) - DeviceTokenDeleteAPIView: Device token deletion (1000 req/hour) Changes: - Added UserRateThrottle import from rest_framework.throttling - Applied throttle_classes = [UserRateThrottle] to all 4 endpoints - Inherits default rate of 1000 requests/hour per user from base settings Security impact: - Prevents brute force attacks on password changes - Mitigates enumeration attacks via profile endpoint - Protects against DoS via excessive device token registration - Complements existing login/register rate limiting 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>