Improve security

src/views/auth/mod.rs

@@ -1,3 +1,4 @@
+use actix_governor::{Governor, GovernorConfigBuilder};
 use actix_web::web;
 use actix_web::web::ServiceConfig;
 
@@ -12,9 +13,19 @@ pub fn auth_factory(app: &mut ServiceConfig) {
         backend: true,
     };
 
-    app.route(
-        &base_path.define(String::from("/login")),
-        web::post().to(login::login),
+    // Login is the only unauthenticated endpoint that checks a password, so
+    // it's the only one worth rate-limiting against brute-force/credential
+    // stuffing. One request every 2s with a burst of 5 per IP.
+    let login_rate_limit = GovernorConfigBuilder::default()
+        .seconds_per_request(2)
+        .burst_size(5)
+        .finish()
+        .expect("valid governor rate-limit config");
+
+    app.service(
+        web::resource(base_path.define(String::from("/login")))
+            .wrap(Governor::new(&login_rate_limit))
+            .route(web::post().to(login::login)),
     );
     app.route(
         &base_path.define(String::from("/logout")),