Feature/add rate limiting to authentication and sign up endpoints (#7263)

* Add rate limiting to authentication and sign up endpoints

* Update changelog

CHANGELOG.md

@@ -10,6 +10,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 - Exposed the `DATA_SOURCE_FEAR_AND_GREED_INDEX_STOCKS` environment variable to set the data source of the _Fear & Greed Index_ (market mood)
+- Exposed the `ENABLE_FEATURE_RATE_LIMITING` environment variable to control rate limiting for authentication and sign-up endpoints
+- Exposed the `TRUST_PROXY` environment variable to determine the client IP address when running behind a reverse proxy
 
 ## 3.23.0 - 2026-07-10
 

README.md

@@ -85,27 +85,28 @@ We provide official container images hosted on [Docker Hub](https://hub.docker.c
 
 ### Supported Environment Variables
 
-| Name                        | Type                  | Default Value         | Description                                                                                                                                                                            |
+| Name                        | Type                  | Default Value         | Description                                                                                                                                                                                                                   |
-| --------------------------- | --------------------- | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| --------------------------- | --------------------- | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `ACCESS_TOKEN_SALT`         | `string`              |                       | A random string used as salt for access tokens                                                                                                                                         |
+| `ACCESS_TOKEN_SALT`         | `string`              |                       | A random string used as salt for access tokens                                                                                                                                                                                |
-| `API_KEY_COINGECKO_DEMO`    | `string` (optional)   |                       | The _CoinGecko_ Demo API key                                                                                                                                                           |
+| `API_KEY_COINGECKO_DEMO`    | `string` (optional)   |                       | The _CoinGecko_ Demo API key                                                                                                                                                                                                  |
-| `API_KEY_COINGECKO_PRO`     | `string` (optional)   |                       | The _CoinGecko_ Pro API key                                                                                                                                                            |
+| `API_KEY_COINGECKO_PRO`     | `string` (optional)   |                       | The _CoinGecko_ Pro API key                                                                                                                                                                                                   |
-| `DATABASE_URL`              | `string`              |                       | The database connection URL. If using a connection pooler, use the pooled connection URL here. e.g. `postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@localhost:5432/${POSTGRES_DB}` |
+| `DATABASE_URL`              | `string`              |                       | The database connection URL. If using a connection pooler, use the pooled connection URL here. e.g. `postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@localhost:5432/${POSTGRES_DB}`                                        |
-| `DIRECT_URL`                | `string` (optional)   |                       | The direct database connection URL used by the _Prisma CLI_ (e.g. for schema migrations) and seeding, bypassing any connection poolers (falls back to `DATABASE_URL`)                  |
+| `DIRECT_URL`                | `string` (optional)   |                       | The direct database connection URL used by the _Prisma CLI_ (e.g. for schema migrations) and seeding, bypassing any connection poolers (falls back to `DATABASE_URL`)                                                         |
-| `ENABLE_FEATURE_AUTH_TOKEN` | `boolean` (optional)  | `true`                | Enables authentication via security token                                                                                                                                              |
+| `ENABLE_FEATURE_AUTH_TOKEN` | `boolean` (optional)  | `true`                | Enables authentication via security token                                                                                                                                                                                     |
-| `HOST`                      | `string` (optional)   | `0.0.0.0`             | The host where the Ghostfolio application will run on                                                                                                                                  |
+| `HOST`                      | `string` (optional)   | `0.0.0.0`             | The host where the Ghostfolio application will run on                                                                                                                                                                         |
-| `JWT_SECRET_KEY`            | `string`              |                       | A random string used for _JSON Web Tokens_ (JWT)                                                                                                                                       |
+| `JWT_SECRET_KEY`            | `string`              |                       | A random string used for _JSON Web Tokens_ (JWT)                                                                                                                                                                              |
-| `LOG_LEVELS`                | `string[]` (optional) |                       | The logging levels for the Ghostfolio application, e.g. `["debug","error","log","warn"]`                                                                                               |
+| `LOG_LEVELS`                | `string[]` (optional) |                       | The logging levels for the Ghostfolio application, e.g. `["debug","error","log","warn"]`                                                                                                                                      |
-| `PORT`                      | `number` (optional)   | `3333`                | The port where the Ghostfolio application will run on                                                                                                                                  |
+| `PORT`                      | `number` (optional)   | `3333`                | The port where the Ghostfolio application will run on                                                                                                                                                                         |
-| `POSTGRES_DB`               | `string`              |                       | The name of the _PostgreSQL_ database                                                                                                                                                  |
+| `POSTGRES_DB`               | `string`              |                       | The name of the _PostgreSQL_ database                                                                                                                                                                                         |
-| `POSTGRES_PASSWORD`         | `string`              |                       | The password of the _PostgreSQL_ database                                                                                                                                              |
+| `POSTGRES_PASSWORD`         | `string`              |                       | The password of the _PostgreSQL_ database                                                                                                                                                                                     |
-| `POSTGRES_USER`             | `string`              |                       | The user of the _PostgreSQL_ database                                                                                                                                                  |
+| `POSTGRES_USER`             | `string`              |                       | The user of the _PostgreSQL_ database                                                                                                                                                                                         |
-| `REDIS_DB`                  | `number` (optional)   | `0`                   | The database index of _Redis_                                                                                                                                                          |
+| `REDIS_DB`                  | `number` (optional)   | `0`                   | The database index of _Redis_                                                                                                                                                                                                 |
-| `REDIS_HOST`                | `string`              |                       | The host where _Redis_ is running                                                                                                                                                      |
+| `REDIS_HOST`                | `string`              |                       | The host where _Redis_ is running                                                                                                                                                                                             |
-| `REDIS_PASSWORD`            | `string`              |                       | The password of _Redis_                                                                                                                                                                |
+| `REDIS_PASSWORD`            | `string`              |                       | The password of _Redis_                                                                                                                                                                                                       |
-| `REDIS_PORT`                | `number`              |                       | The port where _Redis_ is running                                                                                                                                                      |
+| `REDIS_PORT`                | `number`              |                       | The port where _Redis_ is running                                                                                                                                                                                             |
-| `REQUEST_TIMEOUT`           | `number` (optional)   | `2000`                | The timeout of network requests to data providers in milliseconds                                                                                                                      |
+| `REQUEST_TIMEOUT`           | `number` (optional)   | `2000`                | The timeout of network requests to data providers in milliseconds                                                                                                                                                             |
-| `ROOT_URL`                  | `string` (optional)   | `http://0.0.0.0:3333` | The root URL of the Ghostfolio application, used for generating callback URLs and external links.                                                                                      |
+| `ROOT_URL`                  | `string` (optional)   | `http://0.0.0.0:3333` | The root URL of the Ghostfolio application, used for generating callback URLs and external links.                                                                                                                             |
+| `TRUST_PROXY`               | `string` (optional)   |                       | The [trust proxy](https://expressjs.com/en/guide/behind-proxies.html) setting of _Express.js_ to determine the client IP address for rate limiting, e.g. `1` if the Ghostfolio application runs behind a single reverse proxy |
 
 #### OpenID Connect OIDC (experimental)
 

apps/api/src/app/app.module.ts

@@ -1,7 +1,9 @@
 import { EventsModule } from '@ghostfolio/api/events/events.module';
+import { getRedisConnectionOptions } from '@ghostfolio/api/helper/redis.helper';
 import { BullBoardAuthMiddleware } from '@ghostfolio/api/middlewares/bull-board-auth.middleware';
 import { HtmlTemplateMiddleware } from '@ghostfolio/api/middlewares/html-template.middleware';
 import { ConfigurationModule } from '@ghostfolio/api/services/configuration/configuration.module';
+import { ConfigurationService } from '@ghostfolio/api/services/configuration/configuration.service';
 import { CronModule } from '@ghostfolio/api/services/cron/cron.module';
 import { DataProviderModule } from '@ghostfolio/api/services/data-provider/data-provider.module';
 import { ExchangeRateDataModule } from '@ghostfolio/api/services/exchange-rate-data/exchange-rate-data.module';
@@ -13,18 +15,22 @@ import { PortfolioSnapshotQueueModule } from '@ghostfolio/api/services/queues/po
 import {
   BULL_BOARD_ROUTE,
   DEFAULT_LANGUAGE_CODE,
-  SUPPORTED_LANGUAGE_CODES
+  SUPPORTED_LANGUAGE_CODES,
+  THROTTLE_DEFAULT_LIMIT,
+  THROTTLE_DEFAULT_TTL
 } from '@ghostfolio/common/config';
 
 import { ExpressAdapter } from '@bull-board/express';
 import { BullBoardModule } from '@bull-board/nestjs';
+import { ThrottlerStorageRedisService } from '@nest-lab/throttler-storage-redis';
 import { BullModule } from '@nestjs/bull';
 import { MiddlewareConsumer, Module, NestModule } from '@nestjs/common';
 import { ConfigModule } from '@nestjs/config';
 import { EventEmitterModule } from '@nestjs/event-emitter';
 import { ScheduleModule } from '@nestjs/schedule';
 import { ServeStaticModule } from '@nestjs/serve-static';
-import { StatusCodes } from 'http-status-codes';
+import { ThrottlerModule } from '@nestjs/throttler';
+import { getReasonPhrase, StatusCodes } from 'http-status-codes';
 import { join } from 'node:path';
 
 import { AccessModule } from './access/access.module';
@@ -95,12 +101,13 @@ import { UserModule } from './user/user.module';
       middleware: BullBoardAuthMiddleware,
       route: BULL_BOARD_ROUTE
     }),
-    BullModule.forRoot({
+    BullModule.forRootAsync({
-      redis: {
+      imports: [ConfigurationModule],
-        db: parseInt(process.env.REDIS_DB ?? '0', 10),
+      inject: [ConfigurationService],
-        host: process.env.REDIS_HOST,
+      useFactory: (configurationService: ConfigurationService) => {
-        password: process.env.REDIS_PASSWORD,
+        return {
-        port: parseInt(process.env.REDIS_PORT ?? '6379', 10)
+          redis: getRedisConnectionOptions(configurationService)
+        };
       }
     }),
     CacheModule,
@@ -168,6 +175,36 @@ import { UserModule } from './user/user.module';
     SubscriptionModule,
     SymbolModule,
     TagsModule,
+    ThrottlerModule.forRootAsync({
+      imports: [ConfigurationModule],
+      inject: [ConfigurationService],
+      useFactory: (configurationService: ConfigurationService) => {
+        const isRateLimitingEnabled = configurationService.get(
+          'ENABLE_FEATURE_RATE_LIMITING'
+        );
+
+        return {
+          errorMessage: getReasonPhrase(StatusCodes.TOO_MANY_REQUESTS),
+          skipIf: () => {
+            return !isRateLimitingEnabled;
+          },
+          storage: isRateLimitingEnabled
+            ? new ThrottlerStorageRedisService({
+                ...getRedisConnectionOptions(configurationService),
+                // Reject commands immediately while Redis is unavailable
+                enableOfflineQueue: false,
+                maxRetriesPerRequest: 1
+              })
+            : undefined,
+          throttlers: [
+            {
+              limit: THROTTLE_DEFAULT_LIMIT,
+              ttl: THROTTLE_DEFAULT_TTL
+            }
+          ]
+        };
+      }
+    }),
     UserModule,
     WatchlistModule
   ],

apps/api/src/app/auth/auth.controller.ts

@@ -1,4 +1,5 @@
 import { WebAuthService } from '@ghostfolio/api/app/auth/web-auth.service';
+import { CustomThrottlerGuard } from '@ghostfolio/api/guards/custom-throttler.guard';
 import { HasPermissionGuard } from '@ghostfolio/api/guards/has-permission.guard';
 import { ConfigurationService } from '@ghostfolio/api/services/configuration/configuration.service';
 import { DEFAULT_LANGUAGE_CODE } from '@ghostfolio/common/config';
@@ -39,6 +40,7 @@ export class AuthController {
    * @deprecated
    */
   @Get('anonymous/:accessToken')
+  @UseGuards(CustomThrottlerGuard)
   public async accessTokenLoginGet(
     @Param('accessToken') accessToken: string
   ): Promise<OAuthResponse> {
@@ -55,6 +57,7 @@ export class AuthController {
   }
 
   @Post('anonymous')
+  @UseGuards(CustomThrottlerGuard)
   public async accessTokenLogin(
     @Body() body: { accessToken: string }
   ): Promise<OAuthResponse> {
@@ -135,6 +138,7 @@ export class AuthController {
   }
 
   @Post('webauthn/generate-authentication-options')
+  @UseGuards(CustomThrottlerGuard)
   public async generateAuthenticationOptions(
     @Body() body: { deviceId: string }
   ) {
@@ -156,6 +160,7 @@ export class AuthController {
   }
 
   @Post('webauthn/verify-authentication')
+  @UseGuards(CustomThrottlerGuard)
   public async verifyAuthentication(
     @Body() body: { deviceId: string; credential: AssertionCredentialJSON }
   ) {

apps/api/src/app/redis-cache/redis-cache.module.ts

@@ -1,3 +1,4 @@
+import { getRedisConnectionUrl } from '@ghostfolio/api/helper/redis.helper';
 import { ConfigurationModule } from '@ghostfolio/api/services/configuration/configuration.module';
 import { ConfigurationService } from '@ghostfolio/api/services/configuration/configuration.service';
 
@@ -14,16 +15,8 @@ import { RedisCacheService } from './redis-cache.service';
       imports: [ConfigurationModule],
       inject: [ConfigurationService],
       useFactory: async (configurationService: ConfigurationService) => {
-        const redisPassword = encodeURIComponent(
-          configurationService.get('REDIS_PASSWORD')
-        );
-
         return {
-          stores: [
+          stores: [createKeyv(getRedisConnectionUrl(configurationService))],
-            createKeyv(
-              `redis://${redisPassword ? `:${redisPassword}` : ''}@${configurationService.get('REDIS_HOST')}:${configurationService.get('REDIS_PORT')}/${configurationService.get('REDIS_DB')}`
-            )
-          ],
           ttl: configurationService.get('CACHE_TTL')
         };
       }

apps/api/src/app/user/user.controller.ts

@@ -1,11 +1,16 @@
 import { HasPermission } from '@ghostfolio/api/decorators/has-permission.decorator';
+import { CustomThrottlerGuard } from '@ghostfolio/api/guards/custom-throttler.guard';
 import { HasPermissionGuard } from '@ghostfolio/api/guards/has-permission.guard';
 import { RedactValuesInResponseInterceptor } from '@ghostfolio/api/interceptors/redact-values-in-response/redact-values-in-response.interceptor';
 import { ConfigurationService } from '@ghostfolio/api/services/configuration/configuration.service';
 import { ImpersonationService } from '@ghostfolio/api/services/impersonation/impersonation.service';
 import { PrismaService } from '@ghostfolio/api/services/prisma/prisma.service';
 import { PropertyService } from '@ghostfolio/api/services/property/property.service';
-import { HEADER_KEY_IMPERSONATION } from '@ghostfolio/common/config';
+import {
+  HEADER_KEY_IMPERSONATION,
+  THROTTLE_SIGNUP_LIMIT,
+  THROTTLE_SIGNUP_TTL
+} from '@ghostfolio/common/config';
 import {
   DeleteOwnUserDto,
   UpdateOwnAccessTokenDto,
@@ -37,6 +42,7 @@ import {
 import { REQUEST } from '@nestjs/core';
 import { JwtService } from '@nestjs/jwt';
 import { AuthGuard } from '@nestjs/passport';
+import { Throttle } from '@nestjs/throttler';
 import { User as UserModel } from '@prisma/client';
 import { StatusCodes, getReasonPhrase } from 'http-status-codes';
 import { merge, size } from 'lodash';
@@ -128,6 +134,13 @@ export class UserController {
   }
 
   @Post()
+  @Throttle({
+    default: {
+      limit: THROTTLE_SIGNUP_LIMIT,
+      ttl: THROTTLE_SIGNUP_TTL
+    }
+  })
+  @UseGuards(CustomThrottlerGuard)
   public async signupUser(): Promise<UserItem> {
     const isUserSignupEnabled =
       await this.propertyService.isUserSignupEnabled();

apps/api/src/guards/custom-throttler.guard.ts

@@ -0,0 +1,21 @@
+import { ExecutionContext, Injectable, Logger } from '@nestjs/common';
+import { ThrottlerException, ThrottlerGuard } from '@nestjs/throttler';
+
+@Injectable()
+export class CustomThrottlerGuard extends ThrottlerGuard {
+  private readonly logger = new Logger(CustomThrottlerGuard.name);
+
+  public async canActivate(context: ExecutionContext): Promise<boolean> {
+    try {
+      return await super.canActivate(context);
+    } catch (error) {
+      if (error instanceof ThrottlerException) {
+        throw error;
+      }
+
+      this.logger.error(error);
+
+      return true;
+    }
+  }
+}

apps/api/src/helper/redis.helper.ts

@@ -0,0 +1,22 @@
+import { ConfigurationService } from '@ghostfolio/api/services/configuration/configuration.service';
+
+export function getRedisConnectionOptions(
+  configurationService: ConfigurationService
+) {
+  return {
+    db: configurationService.get('REDIS_DB'),
+    host: configurationService.get('REDIS_HOST'),
+    password: configurationService.get('REDIS_PASSWORD'),
+    port: configurationService.get('REDIS_PORT')
+  };
+}
+
+export function getRedisConnectionUrl(
+  configurationService: ConfigurationService
+): string {
+  const { db, host, password, port } =
+    getRedisConnectionOptions(configurationService);
+  const encodedPassword = encodeURIComponent(password);
+
+  return `redis://${encodedPassword ? `:${encodedPassword}` : ''}@${host}:${port}/${db}`;
+}

apps/api/src/main.ts

@@ -1,3 +1,4 @@
+import { ConfigurationService } from '@ghostfolio/api/services/configuration/configuration.service';
 import {
   BULL_BOARD_ROUTE,
   DEFAULT_HOST,
@@ -39,6 +40,8 @@ async function bootstrap() {
     ) as LogLevel[];
   } catch {}
 
+  await configApp.close();
+
   const app = await NestFactory.create<NestExpressApplication>(AppModule, {
     logger:
       customLogLevels ??
@@ -97,6 +100,23 @@ async function bootstrap() {
     });
   }
 
+  const configurationService = app.get(ConfigurationService);
+
+  const trustProxy = configurationService.get('TRUST_PROXY');
+
+  if (trustProxy) {
+    app.set('trust proxy', trustProxy);
+  }
+
+  if (
+    configurationService.get('ENABLE_FEATURE_RATE_LIMITING') &&
+    trustProxy === ''
+  ) {
+    logger.warn(
+      'Rate limiting is enabled, but TRUST_PROXY is not set. If the Ghostfolio application runs behind a reverse proxy, the rate limits are shared across all clients.'
+    );
+  }
+
   const HOST = configService.get<string>('HOST') || DEFAULT_HOST;
   const PORT = configService.get<number>('PORT') || DEFAULT_PORT;
 

apps/api/src/services/configuration/configuration.service.ts

@@ -13,9 +13,31 @@ import {
 
 import { Injectable } from '@nestjs/common';
 import { DataSource } from '@prisma/client';
-import { bool, cleanEnv, host, json, num, port, str, url } from 'envalid';
+import {
+  bool,
+  cleanEnv,
+  host,
+  json,
+  makeValidator,
+  num,
+  port,
+  str,
+  url
+} from 'envalid';
 import ms from 'ms';
 
+const trustProxy = makeValidator<boolean | number | string>((input) => {
+  if (/^\d+$/.test(input)) {
+    return Number(input);
+  } else if (input === 'false') {
+    return false;
+  } else if (input === 'true') {
+    return true;
+  }
+
+  return input;
+});
+
 @Injectable()
 export class ConfigurationService {
   private readonly environmentConfiguration: Environment;
@@ -50,6 +72,7 @@ export class ConfigurationService {
       ENABLE_FEATURE_CRON: bool({ default: true }),
       ENABLE_FEATURE_FEAR_AND_GREED_INDEX: bool({ default: false }),
       ENABLE_FEATURE_GATHER_NEW_EXCHANGE_RATES: bool({ default: true }),
+      ENABLE_FEATURE_RATE_LIMITING: bool({ default: false }),
       ENABLE_FEATURE_READ_ONLY_MODE: bool({ default: false }),
       ENABLE_FEATURE_STATISTICS: bool({ default: false }),
       ENABLE_FEATURE_SUBSCRIPTION: bool({ default: false }),
@@ -114,6 +137,7 @@ export class ConfigurationService {
         default: environment.rootUrl
       }),
       STRIPE_SECRET_KEY: str({ default: '' }),
+      TRUST_PROXY: trustProxy({ default: '' }),
       TWITTER_ACCESS_TOKEN: str({ default: 'dummyAccessToken' }),
       TWITTER_ACCESS_TOKEN_SECRET: str({ default: 'dummyAccessTokenSecret' }),
       TWITTER_API_KEY: str({ default: 'dummyApiKey' }),

apps/api/src/services/interfaces/environment.interface.ts

@@ -23,6 +23,7 @@ export interface Environment extends CleanedEnvAccessors {
   ENABLE_FEATURE_CRON: boolean;
   ENABLE_FEATURE_FEAR_AND_GREED_INDEX: boolean;
   ENABLE_FEATURE_GATHER_NEW_EXCHANGE_RATES: boolean;
+  ENABLE_FEATURE_RATE_LIMITING: boolean;
   ENABLE_FEATURE_READ_ONLY_MODE: boolean;
   ENABLE_FEATURE_STATISTICS: boolean;
   ENABLE_FEATURE_SUBSCRIPTION: boolean;
@@ -57,6 +58,7 @@ export interface Environment extends CleanedEnvAccessors {
   REQUEST_TIMEOUT: number;
   ROOT_URL: string;
   STRIPE_SECRET_KEY: string;
+  TRUST_PROXY: boolean | number | string;
   TWITTER_ACCESS_TOKEN: string;
   TWITTER_ACCESS_TOKEN_SECRET: string;
   TWITTER_API_KEY: string;

apps/client/src/app/components/header/header.component.ts

@@ -22,6 +22,7 @@ import { NotificationService } from '@ghostfolio/ui/notifications';
 import { GfPremiumIndicatorComponent } from '@ghostfolio/ui/premium-indicator';
 import { DataService } from '@ghostfolio/ui/services';
 
+import { HttpErrorResponse } from '@angular/common/http';
 import {
   ChangeDetectionStrategy,
   Component,
@@ -42,6 +43,7 @@ import { MatMenuModule, MatMenuTrigger } from '@angular/material/menu';
 import { MatToolbarModule } from '@angular/material/toolbar';
 import { Router, RouterModule } from '@angular/router';
 import { IonIcon } from '@ionic/angular/standalone';
+import { StatusCodes } from 'http-status-codes';
 import { addIcons } from 'ionicons';
 import {
   closeOutline,
@@ -315,10 +317,15 @@ export class GfHeaderComponent implements OnChanges {
           this.dataService
             .loginAnonymous(data?.accessToken)
             .pipe(
-              catchError(() => {
+              catchError((error: HttpErrorResponse) => {
-                this.notificationService.alert({
+                if (error.status !== StatusCodes.TOO_MANY_REQUESTS) {
-                  title: $localize`Oops! Incorrect Security Token.`
+                  // The notification for too many requests is handled in the
-                });
+                  // HttpResponseInterceptor
+
+                  this.notificationService.alert({
+                    title: $localize`Oops! Incorrect Security Token.`
+                  });
+                }
 
                 return EMPTY;
               }),

apps/client/src/app/core/http-response.interceptor.ts

@@ -98,15 +98,23 @@ export class HttpResponseInterceptor implements HttpInterceptor {
             });
           }
         } else if (error.status === StatusCodes.TOO_MANY_REQUESTS) {
-          if (!this.snackBarRef) {
+          // Replace an already visible snack bar so that the rate limiting
-            this.snackBarRef = this.snackBar.open(
+          // feedback is not swallowed
-              $localize`Oops! It looks like you’re making too many requests. Please slow down a bit.`
+          const snackBarRef = this.snackBar.open(
-            );
+            $localize`Oops! It looks like you’re making too many requests. Please slow down a bit.`,
+            undefined,
+            {
+              duration: ms('6 seconds')
+            }
+          );
 
-            this.snackBarRef?.afterDismissed().subscribe(() => {
+          snackBarRef.afterDismissed().subscribe(() => {
+            if (this.snackBarRef === snackBarRef) {
               this.snackBarRef = undefined;
-            });
+            }
-          }
+          });
+
+          this.snackBarRef = snackBarRef;
         } else if (error.status === StatusCodes.UNAUTHORIZED) {
           if (!error.url?.includes('/data-providers/ghostfolio/status')) {
             if (this.webAuthnService.isEnabled()) {

libs/common/src/lib/config.ts

@@ -329,4 +329,9 @@ export const TAG_ID_EXCLUDE_FROM_ANALYSIS =
   'f2e868af-8333-459f-b161-cbc6544c24bd';
 export const TAG_ID_DEMO = 'efa08cb3-9b9d-4974-ac68-db13a19c4874';
 
+export const THROTTLE_DEFAULT_LIMIT = 10;
+export const THROTTLE_DEFAULT_TTL = ms('1 minute');
+export const THROTTLE_SIGNUP_LIMIT = 5;
+export const THROTTLE_SIGNUP_TTL = ms('1 hour');
+
 export const UNKNOWN_KEY = 'UNKNOWN';

package-lock.json

@@ -29,6 +29,7 @@
         "@internationalized/number": "3.6.7",
         "@ionic/angular": "8.8.12",
         "@keyv/redis": "5.1.6",
+        "@nest-lab/throttler-storage-redis": "1.2.0",
         "@nestjs/bull": "11.0.4",
         "@nestjs/cache-manager": "3.1.3",
         "@nestjs/common": "11.1.27",
@@ -40,6 +41,7 @@
         "@nestjs/platform-express": "11.1.27",
         "@nestjs/schedule": "6.1.3",
         "@nestjs/serve-static": "5.0.5",
+        "@nestjs/throttler": "6.5.0",
         "@openrouter/ai-sdk-provider": "2.9.1",
         "@prisma/adapter-pg": "7.8.0",
         "@prisma/client": "7.8.0",
@@ -6956,6 +6958,39 @@
         "tslib": "^2.4.0"
       }
     },
+    "node_modules/@nest-lab/throttler-storage-redis": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/@nest-lab/throttler-storage-redis/-/throttler-storage-redis-1.2.0.tgz",
+      "integrity": "sha512-tMkUyo68NCKTR+zILk+EC35SMYBtDPZY2mCj7ZaCietWGVTnuP4zwq9ERYfvU6kJv6h8teNZrC6MJCmY6/dljw==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.3.0"
+      },
+      "peerDependencies": {
+        "@nestjs/common": "^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0",
+        "@nestjs/core": "^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0",
+        "@nestjs/throttler": ">=6.0.0",
+        "ioredis": ">=5.0.0",
+        "reflect-metadata": "^0.2.1"
+      },
+      "peerDependenciesMeta": {
+        "@nestjs/common": {
+          "optional": false
+        },
+        "@nestjs/core": {
+          "optional": false
+        },
+        "@nestjs/throttler": {
+          "optional": false
+        },
+        "ioredis": {
+          "optional": false
+        },
+        "reflect-metadata": {
+          "optional": false
+        }
+      }
+    },
     "node_modules/@nestjs/bull": {
       "version": "11.0.4",
       "resolved": "https://registry.npmjs.org/@nestjs/bull/-/bull-11.0.4.tgz",
@@ -7441,6 +7476,17 @@
         }
       }
     },
+    "node_modules/@nestjs/throttler": {
+      "version": "6.5.0",
+      "resolved": "https://registry.npmjs.org/@nestjs/throttler/-/throttler-6.5.0.tgz",
+      "integrity": "sha512-9j0ZRfH0QE1qyrj9JjIRDz5gQLPqq9yVC2nHsrosDVAfI5HHw08/aUAWx9DZLSdQf4HDkmhTTEGLrRFHENvchQ==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@nestjs/common": "^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0",
+        "@nestjs/core": "^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0",
+        "reflect-metadata": "^0.1.13 || ^0.2.0"
+      }
+    },
     "node_modules/@ngtools/webpack": {
       "version": "21.2.6",
       "resolved": "https://registry.npmjs.org/@ngtools/webpack/-/webpack-21.2.6.tgz",

package.json

@@ -73,6 +73,7 @@
     "@internationalized/number": "3.6.7",
     "@ionic/angular": "8.8.12",
     "@keyv/redis": "5.1.6",
+    "@nest-lab/throttler-storage-redis": "1.2.0",
     "@nestjs/bull": "11.0.4",
     "@nestjs/cache-manager": "3.1.3",
     "@nestjs/common": "11.1.27",
@@ -84,6 +85,7 @@
     "@nestjs/platform-express": "11.1.27",
     "@nestjs/schedule": "6.1.3",
     "@nestjs/serve-static": "5.0.5",
+    "@nestjs/throttler": "6.5.0",
     "@openrouter/ai-sdk-provider": "2.9.1",
     "@prisma/adapter-pg": "7.8.0",
     "@prisma/client": "7.8.0",