BA-020 — Add login and refresh rate limiting

[MaryammAli]

• Type: Security
• Affected area: auth controllers, throttling configuration
• BackendAcademy
• Summary: Session endpoints are high-value abuse targets and need separate limits from ordinary API traffic.
• Acceptance criteria: Limits are applied per IP and account identifier; responses include retry metadata; limits are configurable and observable.

[sagesan2580]

@sagesan2580 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello maintainer, can I be assigned to this issue?

ℹ️ Repo Maintainers: To accept this application, review their application or assign @sagesan2580 to this issue.

[edochieblessing09-max]

@edochieblessing09-max has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I’d like to work on this issue. I understand the problem described and I’m confident I can investigate it, implement the necessary changes, and test the solution properly.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @edochieblessing09-max to this issue.

[Alimzy]

@Alimzy has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi! I'd like to work on this issue.

I'm a software engineer with hands-on experience in testing, debugging, and building reliable features across the stack. I'm confident I can take this on and deliver a solid, well-tested solution that follows the project's existing conventions.

I'll make sure to cover the core functionality as well as relevant edge cases to keep things reliable and regression-resistant.

Let me know if I can get started, and I'll provide updates as I progress.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Alimzy to this issue.

[kingsrichie79-cmyk]

@kingsrichie79-cmyk has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I’m interested in taking this issue. I’ll review the existing implementation, identify the cause of the problem, and work on a clean solution while making sure I don’t introduce new issues.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @kingsrichie79-cmyk to this issue.

[drips-wave]

Congratulations, @Alimzy! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @Alimzy: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊