Login brute-force lockout only tracks per-account; IP rotation bypasses it completely

[anshul23102]

Summary

checkLockout / recordFailedAttempt in userAuth.controller.js gate failed attempts per user account. An attacker using a botnet or simple IP rotation can run unlimited password-spray attacks against any email address without ever triggering the lockout.

Impact

• Credential stuffing and password spray attacks succeed unimpeded.
• Accounts with weak or reused passwords are compromised silently.

Suggested Fix

Implement a two-dimensional rate limit:

1. Per-account lockout after N failures (already present) - keep this.
2. Per-IP rate limiting via express-rate-limit on the /login route (missing).
3. Optional: CAPTCHA challenge after 3 failures.

const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 20,
  keyGenerator: (req) => req.ip,
});
router.post('/login', loginLimiter, loginController);

[anshul23102]

@geturbackend Could you please assign this issue to me? I'd like to work on it under GSSoC '26.
/assign
/claim