Review: rate-limit the password reset endpoint

Reviewer: Sofia Lindqvist · Date: 2026-06-03 · PR/Diff: northwind/web#4821

Change summary

Adds a per-email and per-IP limit (5 requests per 15 minutes) to POST /auth/reset, backed by the existing Redis bucket helper, and returns the same 202 response whether or not the address exists so the endpoint cannot be used to enumerate accounts.

Correctness

• Logic matches the stated intent (ticket SEC-218)
• Edge cases handled: email is lowercased and trimmed before it becomes a bucket key
• Error paths fail loudly or degrade safely: if Redis is down the limiter currently fails open with no log line (asked for a warn log, see notes)

Tests

• New behavior has a test that would fail without the fix (sixth request returns 429)
• Tests assert behavior, not implementation details
• No skipped/flaky tests introduced

Security

• Input validated at the trust boundary
• No secrets, tokens or PII logged: the bucket key is hashed before logging
• Checks are on the server

Performance

• One Redis round trip per request, no new queries
• n/a: not a hot path (about 300 requests per day)

Readability

• Names say what things are (resetLimiter, bucketKeyFor)
• Complexity matches the problem

Operability

• New failure modes are observable: needs a counter for 429s so support can tell a real user from an attack
• Rollback is a revert, no migration

Docs

• Help center article on password reset updated with the "try again in 15 minutes" message

Reviewer notes

Approved with two follow-ups owned by Kenji Watanabe: a warn log when the limiter fails open (SEC-221) and an auth_reset_limited_total metric (SEC-222), both due before the next release on June 10.