Application-level rate limiting for signups and login attempts

[tefkah]

Motivation

Since we now have public signup after #1114 lands, we could expect some spam signups to happen.

Especially for self-hosted instances, we should have some way of limiting the amount of signups/login attempts that can happen per IP + UA combo.

Requirements

• Determine a good rate limit (e.g. requests per minute) for the signup and login pages.
• Limit the number of requests an individual IP + UA combo can make to our signup and login pages to the limits(s) you selected.

Acceptance Criteria

• Justify the chosen limit(s) with some napkin math.
• Must use the key/value store from Autocache using redis #1131 to store the time of the last request to each application-level rate-limited endpoint (signup and login) by IP address + UA combo.
• Must add an end-to-end test that demonstrates rate limiting working for both signups and login attempts.
• May want to use a library to find originating IP (e.g. https://www.npmjs.com/package/@arcjet/ip)

[kalilsn]

Though I did just suggest we add a redis instance for caching, I'm not sure we actually need to use that for rate limiting. Since we're running nginx, we can just rate limit there, by ip or session cookie or api key

[tefkah]

we could, for self-hosting users it might be more tricky, especially updating their caddy/nginx config if we add/change the routes that should be rate limited

i think doing it at the application level is somewhat more robust and configurable, although probably less performant and more complex

my pref is doing it in the application layer

[tefkah]

We discussed this briefly during the dev symposium. Conclusion was roughly: probably best to do rate limiting at ingress (nginx, caddy) and use redis/valkey at the application level for more specific spam protection, eg limiting the number of times a user can submit a form etc.

[gabestein]

Note: IP-only limiting isn't great, as lots of universities use NATs and do things like "hi new class of 100, everyone signup right now"