[Feature] Implement rate limiting for login

[mrjackwills]

I have searched the existing feature requests, both open and closed, to make sure this is not a duplicate request.

• Yes

The feature

As it stands, Immich does not implement any rate limting for its login endpoint - https://example.com/api/auth/login.

Implementing a Redis/ValKey backed rate limiter, using both the email address in the request body and the requesters IP address as two separate keys, would massively increase the security and safety of the software.

I understand that OAuth is available, but the setup and maintenance of such is most likely beyond the capability of many current and future users of Immich.

As it stands, I can attempt to login to my instance, using the same email address & IP address, thousands of times a minute, with no 429 response or lockout, after which a correct email + password combination result in a valid session being created.

Without the use of Two Factor Authentication, and using the potentially weakened Bcrypt password hashing algorithm, it really feels like Rate Limiting is a vital feature that should be implemented as soon as possible.

Platform

• Server
• Web
• Mobile

[github-actions[bot]]

This discussion has automatically been closed as it is likely a duplicate. We get a lot of duplicate threads each day, which is why we ask you in the template to confirm that you searched for duplicates before opening one. If you're sure this is not a duplicate, please leave a comment and we will reopen the thread if necessary.

[mrjackwills]

I can confirm that this is not a duplicate, and hope it can get re-opened.

[bo0tzz]

It absolutely is a duplicate, as recently as yesterday (#21132). Dupe of #18861.