Audience: Application developers
Editorial status: Published — Source Validated
Product: FeraAuth
Classification: public
Authentication rate limiting
All authentication entry points are protected in the service layer, so the /api/auth and /api/v1/auth aliases cannot bypass controls:
| Entry point | Method checked | Protection |
|---|---|---|
/, /local, /caldav/verify |
password/API identity | source burst/sustained/extended and account-key GCRA |
/reset, /change, /verify/token |
reset credential | source or token-fingerprint GCRA |
/challenge/pre, /challenge/send, /challenge/verify |
challenge/OTP | source and token-fingerprint GCRA |
x-auth-token middleware and /verify/session |
bearer token | only invalid tokens are fingerprint/source limited; valid API traffic keeps normal quotas |
/users/verify |
password reauthentication | authenticated route; add the same password limiter before exposing it publicly |
The shared limiter uses an InnoDB AuthRateLimit table and a transaction with SELECT ... FOR UPDATE, giving atomic GCRA token scheduling across processes and instances. Keys are HMAC-SHA-256 digests and never contain credentials. Expired rows are removed opportunistically.
Defaults are source 5/10 seconds, 20/minute, 100/15 minutes; account 5/15 minutes; invalid bearer tokens 30/minute/source and 10/minute/fingerprint. Requests over a limit return the standard error shape with 429 and Retry-After. Unknown accounts and invalid credentials retain generic responses.
Set FERA_AUTH_LIMITER_HMAC_KEY to a stable secret shared by all instances. Set FERA_AUTH_TRUSTED_PROXIES to a comma-separated list of exact proxy IPs before enabling forwarded-client-IP handling; otherwise the socket peer is used. Invalid or missing threshold values fall back to secure defaults. If MySQL limiter operations fail, a bounded local emergency GCRA is used and the failure is logged as auth_limiter_store_failure; this is intentionally conservative and not an unlimited bypass.
Production deployment should provision/monitor the table, alert on limiter-store failures and auth_limiter_store_failure, and adjust thresholds only from observed legitimate traffic and attack telemetry.
Source
feradelinc/feradel.auth.api branch agent/auth-security-hardening, commit 8e09b7213fdbc5e0e1552d5271dbeee768e9dd88
docs/api/authentication-rate-limiting.md