auth-rate-limit.middleware.ts:14,29-40 keys on req.headers['x-forwarded-for'] without sanitization (an attacker rotating that header bypasses the 5/min login cap); writes TTL as { ttl: this.windowSeconds } (the cache-manager v4 shape — under v5 the arg must be milliseconds, so entries may never expire or expire at the wrong time); re-sets the counter on every hit (resetting the window each request); and fails open on any cache error (disabling brute-force protection during a cache outage). Fix: derive client IP from trusted-proxy config, use the correct TTL unit, avoid resetting TTL on increment, and fail closed for auth.
auth-rate-limit.middleware.ts:14,29-40 keys on
req.headers['x-forwarded-for']without sanitization (an attacker rotating that header bypasses the 5/min login cap); writes TTL as{ ttl: this.windowSeconds }(the cache-manager v4 shape — under v5 the arg must be milliseconds, so entries may never expire or expire at the wrong time); re-sets the counter on every hit (resetting the window each request); and fails open on any cache error (disabling brute-force protection during a cache outage). Fix: derive client IP from trusted-proxy config, use the correct TTL unit, avoid resetting TTL on increment, and fail closed for auth.