Feature/add rate limiting to authentication and sign up endpoints (#7263)

* Add rate limiting to authentication and sign up endpoints * Update changelog
4 days ago · d207d7a753
16 changed files with 259 additions and 51 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -10,6 +10,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added

 - Exposed the `DATA_SOURCE_FEAR_AND_GREED_INDEX_STOCKS` environment variable to set the data source of the _Fear & Greed Index_ (market mood)
+- Exposed the `ENABLE_FEATURE_RATE_LIMITING` environment variable to control rate limiting for authentication and sign-up endpoints
+- Exposed the `TRUST_PROXY` environment variable to determine the client IP address when running behind a reverse proxy

 ## 3.23.0 - 2026-07-10

--- a/README.md
+++ b/README.md
@ -86,7 +86,7 @@ We provide official container images hosted on [Docker Hub](https://hub.docker.c
 ### Supported Environment Variables

 | Name                        | Type                  | Default Value         | Description                                                                                                                                                                                                                   |
-| --------------------------- | --------------------- | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| --------------------------- | --------------------- | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `ACCESS_TOKEN_SALT`         | `string`              |                       | A random string used as salt for access tokens                                                                                                                                                                                |
 | `API_KEY_COINGECKO_DEMO`    | `string` (optional)   |                       | The _CoinGecko_ Demo API key                                                                                                                                                                                                  |
 | `API_KEY_COINGECKO_PRO`     | `string` (optional)   |                       | The _CoinGecko_ Pro API key                                                                                                                                                                                                   |
@ -106,6 +106,7 @@ We provide official container images hosted on [Docker Hub](https://hub.docker.c
 | `REDIS_PORT`                | `number`              |                       | The port where _Redis_ is running                                                                                                                                                                                             |
 | `REQUEST_TIMEOUT`           | `number` (optional)   | `2000`                | The timeout of network requests to data providers in milliseconds                                                                                                                                                             |
 | `ROOT_URL`                  | `string` (optional)   | `http://0.0.0.0:3333` | The root URL of the Ghostfolio application, used for generating callback URLs and external links.                                                                                                                             |
+| `TRUST_PROXY`               | `string` (optional)   |                       | The [trust proxy](https://expressjs.com/en/guide/behind-proxies.html) setting of _Express.js_ to determine the client IP address for rate limiting, e.g. `1` if the Ghostfolio application runs behind a single reverse proxy |

 #### OpenID Connect OIDC (experimental)

--- a/apps/api/src/app/app.module.ts
+++ b/apps/api/src/app/app.module.ts
@ -1,7 +1,9 @@
 import { EventsModule } from '@ghostfolio/api/events/events.module';
+import { getRedisConnectionOptions } from '@ghostfolio/api/helper/redis.helper';
 import { BullBoardAuthMiddleware } from '@ghostfolio/api/middlewares/bull-board-auth.middleware';
 import { HtmlTemplateMiddleware } from '@ghostfolio/api/middlewares/html-template.middleware';
 import { ConfigurationModule } from '@ghostfolio/api/services/configuration/configuration.module';
+import { ConfigurationService } from '@ghostfolio/api/services/configuration/configuration.service';
 import { CronModule } from '@ghostfolio/api/services/cron/cron.module';
 import { DataProviderModule } from '@ghostfolio/api/services/data-provider/data-provider.module';
 import { ExchangeRateDataModule } from '@ghostfolio/api/services/exchange-rate-data/exchange-rate-data.module';
@ -13,18 +15,22 @@ import { PortfolioSnapshotQueueModule } from '@ghostfolio/api/services/queues/po
 import {
  BULL_BOARD_ROUTE,
  DEFAULT_LANGUAGE_CODE,
-  SUPPORTED_LANGUAGE_CODES
+  SUPPORTED_LANGUAGE_CODES,
+  THROTTLE_DEFAULT_LIMIT,
+  THROTTLE_DEFAULT_TTL
 } from '@ghostfolio/common/config';

 import { ExpressAdapter } from '@bull-board/express';
 import { BullBoardModule } from '@bull-board/nestjs';
+import { ThrottlerStorageRedisService } from '@nest-lab/throttler-storage-redis';
 import { BullModule } from '@nestjs/bull';
 import { MiddlewareConsumer, Module, NestModule } from '@nestjs/common';
 import { ConfigModule } from '@nestjs/config';
 import { EventEmitterModule } from '@nestjs/event-emitter';
 import { ScheduleModule } from '@nestjs/schedule';
 import { ServeStaticModule } from '@nestjs/serve-static';
-import { StatusCodes } from 'http-status-codes';
+import { ThrottlerModule } from '@nestjs/throttler';
+import { getReasonPhrase, StatusCodes } from 'http-status-codes';
 import { join } from 'node:path';

 import { AccessModule } from './access/access.module';
@ -95,12 +101,13 @@ import { UserModule } from './user/user.module';
      middleware: BullBoardAuthMiddleware,
      route: BULL_BOARD_ROUTE
    }),
-    BullModule.forRoot({
-      redis: {
-        db: parseInt(process.env.REDIS_DB ?? '0', 10),
-        host: process.env.REDIS_HOST,
-        password: process.env.REDIS_PASSWORD,
-        port: parseInt(process.env.REDIS_PORT ?? '6379', 10)
+    BullModule.forRootAsync({
+      imports: [ConfigurationModule],
+      inject: [ConfigurationService],
+      useFactory: (configurationService: ConfigurationService) => {
+        return {
+          redis: getRedisConnectionOptions(configurationService)
+        };
      }
    }),
    CacheModule,
@ -168,6 +175,36 @@ import { UserModule } from './user/user.module';
    SubscriptionModule,
    SymbolModule,
    TagsModule,
+    ThrottlerModule.forRootAsync({
+      imports: [ConfigurationModule],
+      inject: [ConfigurationService],
+      useFactory: (configurationService: ConfigurationService) => {
+        const isRateLimitingEnabled = configurationService.get(
+          'ENABLE_FEATURE_RATE_LIMITING'
+        );
+
+        return {
+          errorMessage: getReasonPhrase(StatusCodes.TOO_MANY_REQUESTS),
+          skipIf: () => {
+            return !isRateLimitingEnabled;
+          },
+          storage: isRateLimitingEnabled
+            ? new ThrottlerStorageRedisService({
+                ...getRedisConnectionOptions(configurationService),
+                // Reject commands immediately while Redis is unavailable
+                enableOfflineQueue: false,
+                maxRetriesPerRequest: 1
+              })
+            : undefined,
+          throttlers: [
+            {
+              limit: THROTTLE_DEFAULT_LIMIT,
+              ttl: THROTTLE_DEFAULT_TTL
+            }
+          ]
+        };
+      }
+    }),
    UserModule,
    WatchlistModule
  ],
--- a/apps/api/src/app/auth/auth.controller.ts
+++ b/apps/api/src/app/auth/auth.controller.ts
@ -1,4 +1,5 @@
 import { WebAuthService } from '@ghostfolio/api/app/auth/web-auth.service';
+import { CustomThrottlerGuard } from '@ghostfolio/api/guards/custom-throttler.guard';
 import { HasPermissionGuard } from '@ghostfolio/api/guards/has-permission.guard';
 import { ConfigurationService } from '@ghostfolio/api/services/configuration/configuration.service';
 import { DEFAULT_LANGUAGE_CODE } from '@ghostfolio/common/config';
@ -39,6 +40,7 @@ export class AuthController {
   * @deprecated
   */
  @Get('anonymous/:accessToken')
+  @UseGuards(CustomThrottlerGuard)
  public async accessTokenLoginGet(
    @Param('accessToken') accessToken: string
  ): Promise<OAuthResponse> {
@ -55,6 +57,7 @@ export class AuthController {
  }

  @Post('anonymous')
+  @UseGuards(CustomThrottlerGuard)
  public async accessTokenLogin(
    @Body() body: { accessToken: string }
  ): Promise<OAuthResponse> {
@ -135,6 +138,7 @@ export class AuthController {
  }

  @Post('webauthn/generate-authentication-options')
+  @UseGuards(CustomThrottlerGuard)
  public async generateAuthenticationOptions(
    @Body() body: { deviceId: string }
  ) {
@ -156,6 +160,7 @@ export class AuthController {
  }

  @Post('webauthn/verify-authentication')
+  @UseGuards(CustomThrottlerGuard)
  public async verifyAuthentication(
    @Body() body: { deviceId: string; credential: AssertionCredentialJSON }
  ) {
--- a/apps/api/src/app/redis-cache/redis-cache.module.ts
+++ b/apps/api/src/app/redis-cache/redis-cache.module.ts
@ -1,3 +1,4 @@
+import { getRedisConnectionUrl } from '@ghostfolio/api/helper/redis.helper';
 import { ConfigurationModule } from '@ghostfolio/api/services/configuration/configuration.module';
 import { ConfigurationService } from '@ghostfolio/api/services/configuration/configuration.service';

@ -14,16 +15,8 @@ import { RedisCacheService } from './redis-cache.service';
      imports: [ConfigurationModule],
      inject: [ConfigurationService],
      useFactory: async (configurationService: ConfigurationService) => {
-        const redisPassword = encodeURIComponent(
-          configurationService.get('REDIS_PASSWORD')
-        );
-
        return {
-          stores: [
-            createKeyv(
-              `redis://${redisPassword ? `:${redisPassword}` : ''}@${configurationService.get('REDIS_HOST')}:${configurationService.get('REDIS_PORT')}/${configurationService.get('REDIS_DB')}`
-            )
-          ],
+          stores: [createKeyv(getRedisConnectionUrl(configurationService))],
          ttl: configurationService.get('CACHE_TTL')
        };
      }
--- a/apps/api/src/app/user/user.controller.ts
+++ b/apps/api/src/app/user/user.controller.ts
@ -1,11 +1,16 @@
 import { HasPermission } from '@ghostfolio/api/decorators/has-permission.decorator';
+import { CustomThrottlerGuard } from '@ghostfolio/api/guards/custom-throttler.guard';
 import { HasPermissionGuard } from '@ghostfolio/api/guards/has-permission.guard';
 import { RedactValuesInResponseInterceptor } from '@ghostfolio/api/interceptors/redact-values-in-response/redact-values-in-response.interceptor';
 import { ConfigurationService } from '@ghostfolio/api/services/configuration/configuration.service';
 import { ImpersonationService } from '@ghostfolio/api/services/impersonation/impersonation.service';
 import { PrismaService } from '@ghostfolio/api/services/prisma/prisma.service';
 import { PropertyService } from '@ghostfolio/api/services/property/property.service';
-import { HEADER_KEY_IMPERSONATION } from '@ghostfolio/common/config';
+import {
+  HEADER_KEY_IMPERSONATION,
+  THROTTLE_SIGNUP_LIMIT,
+  THROTTLE_SIGNUP_TTL
+} from '@ghostfolio/common/config';
 import {
  DeleteOwnUserDto,
  UpdateOwnAccessTokenDto,
@ -37,6 +42,7 @@ import {
 import { REQUEST } from '@nestjs/core';
 import { JwtService } from '@nestjs/jwt';
 import { AuthGuard } from '@nestjs/passport';
+import { Throttle } from '@nestjs/throttler';
 import { User as UserModel } from '@prisma/client';
 import { StatusCodes, getReasonPhrase } from 'http-status-codes';
 import { merge, size } from 'lodash';
@ -128,6 +134,13 @@ export class UserController {
  }

  @Post()
+  @Throttle({
+    default: {
+      limit: THROTTLE_SIGNUP_LIMIT,
+      ttl: THROTTLE_SIGNUP_TTL
+    }
+  })
+  @UseGuards(CustomThrottlerGuard)
  public async signupUser(): Promise<UserItem> {
    const isUserSignupEnabled =
      await this.propertyService.isUserSignupEnabled();
--- a/apps/api/src/guards/custom-throttler.guard.ts
+++ b/apps/api/src/guards/custom-throttler.guard.ts
@ -0,0 +1,21 @@
+import { ExecutionContext, Injectable, Logger } from '@nestjs/common';
+import { ThrottlerException, ThrottlerGuard } from '@nestjs/throttler';
+
+@Injectable()
+export class CustomThrottlerGuard extends ThrottlerGuard {
+  private readonly logger = new Logger(CustomThrottlerGuard.name);
+
+  public async canActivate(context: ExecutionContext): Promise<boolean> {
+    try {
+      return await super.canActivate(context);
+    } catch (error) {
+      if (error instanceof ThrottlerException) {
+        throw error;
+      }
+
+      this.logger.error(error);
+
+      return true;
+    }
+  }
+}
--- a/apps/api/src/helper/redis.helper.ts
+++ b/apps/api/src/helper/redis.helper.ts
@ -0,0 +1,22 @@
+import { ConfigurationService } from '@ghostfolio/api/services/configuration/configuration.service';
+
+export function getRedisConnectionOptions(
+  configurationService: ConfigurationService
+) {
+  return {
+    db: configurationService.get('REDIS_DB'),
+    host: configurationService.get('REDIS_HOST'),
+    password: configurationService.get('REDIS_PASSWORD'),
+    port: configurationService.get('REDIS_PORT')
+  };
+}
+
+export function getRedisConnectionUrl(
+  configurationService: ConfigurationService
+): string {
+  const { db, host, password, port } =
+    getRedisConnectionOptions(configurationService);
+  const encodedPassword = encodeURIComponent(password);
+
+  return `redis://${encodedPassword ? `:${encodedPassword}` : ''}@${host}:${port}/${db}`;
+}
--- a/apps/api/src/main.ts
+++ b/apps/api/src/main.ts
@ -1,3 +1,4 @@
+import { ConfigurationService } from '@ghostfolio/api/services/configuration/configuration.service';
 import {
  BULL_BOARD_ROUTE,
  DEFAULT_HOST,
@ -39,6 +40,8 @@ async function bootstrap() {
    ) as LogLevel[];
  } catch {}

+  await configApp.close();
+
  const app = await NestFactory.create<NestExpressApplication>(AppModule, {
    logger:
      customLogLevels ??
@ -97,6 +100,23 @@ async function bootstrap() {
    });
  }

+  const configurationService = app.get(ConfigurationService);
+
+  const trustProxy = configurationService.get('TRUST_PROXY');
+
+  if (trustProxy) {
+    app.set('trust proxy', trustProxy);
+  }
+
+  if (
+    configurationService.get('ENABLE_FEATURE_RATE_LIMITING') &&
+    trustProxy === ''
+  ) {
+    logger.warn(
+      'Rate limiting is enabled, but TRUST_PROXY is not set. If the Ghostfolio application runs behind a reverse proxy, the rate limits are shared across all clients.'
+    );
+  }
+
  const HOST = configService.get<string>('HOST') || DEFAULT_HOST;
  const PORT = configService.get<number>('PORT') || DEFAULT_PORT;

--- a/apps/api/src/services/configuration/configuration.service.ts
+++ b/apps/api/src/services/configuration/configuration.service.ts
@ -13,9 +13,31 @@ import {

 import { Injectable } from '@nestjs/common';
 import { DataSource } from '@prisma/client';
-import { bool, cleanEnv, host, json, num, port, str, url } from 'envalid';
+import {
+  bool,
+  cleanEnv,
+  host,
+  json,
+  makeValidator,
+  num,
+  port,
+  str,
+  url
+} from 'envalid';
 import ms from 'ms';

+const trustProxy = makeValidator<boolean | number | string>((input) => {
+  if (/^\d+$/.test(input)) {
+    return Number(input);
+  } else if (input === 'false') {
+    return false;
+  } else if (input === 'true') {
+    return true;
+  }
+
+  return input;
+});
+
@Injectable()
 export class ConfigurationService {
  private readonly environmentConfiguration: Environment;
@ -50,6 +72,7 @@ export class ConfigurationService {
      ENABLE_FEATURE_CRON: bool({ default: true }),
      ENABLE_FEATURE_FEAR_AND_GREED_INDEX: bool({ default: false }),
      ENABLE_FEATURE_GATHER_NEW_EXCHANGE_RATES: bool({ default: true }),
+      ENABLE_FEATURE_RATE_LIMITING: bool({ default: false }),
      ENABLE_FEATURE_READ_ONLY_MODE: bool({ default: false }),
      ENABLE_FEATURE_STATISTICS: bool({ default: false }),
      ENABLE_FEATURE_SUBSCRIPTION: bool({ default: false }),
@ -114,6 +137,7 @@ export class ConfigurationService {
        default: environment.rootUrl
      }),
      STRIPE_SECRET_KEY: str({ default: '' }),
+      TRUST_PROXY: trustProxy({ default: '' }),
      TWITTER_ACCESS_TOKEN: str({ default: 'dummyAccessToken' }),
      TWITTER_ACCESS_TOKEN_SECRET: str({ default: 'dummyAccessTokenSecret' }),
      TWITTER_API_KEY: str({ default: 'dummyApiKey' }),
--- a/apps/api/src/services/interfaces/environment.interface.ts
+++ b/apps/api/src/services/interfaces/environment.interface.ts
@ -23,6 +23,7 @@ export interface Environment extends CleanedEnvAccessors {
  ENABLE_FEATURE_CRON: boolean;
  ENABLE_FEATURE_FEAR_AND_GREED_INDEX: boolean;
  ENABLE_FEATURE_GATHER_NEW_EXCHANGE_RATES: boolean;
+  ENABLE_FEATURE_RATE_LIMITING: boolean;
  ENABLE_FEATURE_READ_ONLY_MODE: boolean;
  ENABLE_FEATURE_STATISTICS: boolean;
  ENABLE_FEATURE_SUBSCRIPTION: boolean;
@ -57,6 +58,7 @@ export interface Environment extends CleanedEnvAccessors {
  REQUEST_TIMEOUT: number;
  ROOT_URL: string;
  STRIPE_SECRET_KEY: string;
+  TRUST_PROXY: boolean | number | string;
  TWITTER_ACCESS_TOKEN: string;
  TWITTER_ACCESS_TOKEN_SECRET: string;
  TWITTER_API_KEY: string;
--- a/apps/client/src/app/components/header/header.component.ts
+++ b/apps/client/src/app/components/header/header.component.ts
@ -22,6 +22,7 @@ import { NotificationService } from '@ghostfolio/ui/notifications';
 import { GfPremiumIndicatorComponent } from '@ghostfolio/ui/premium-indicator';
 import { DataService } from '@ghostfolio/ui/services';

+import { HttpErrorResponse } from '@angular/common/http';
 import {
  ChangeDetectionStrategy,
  Component,
@ -42,6 +43,7 @@ import { MatMenuModule, MatMenuTrigger } from '@angular/material/menu';
 import { MatToolbarModule } from '@angular/material/toolbar';
 import { Router, RouterModule } from '@angular/router';
 import { IonIcon } from '@ionic/angular/standalone';
+import { StatusCodes } from 'http-status-codes';
 import { addIcons } from 'ionicons';
 import {
  closeOutline,
@ -315,10 +317,15 @@ export class GfHeaderComponent implements OnChanges {
          this.dataService
            .loginAnonymous(data?.accessToken)
            .pipe(
-              catchError(() => {
+              catchError((error: HttpErrorResponse) => {
+                if (error.status !== StatusCodes.TOO_MANY_REQUESTS) {
+                  // The notification for too many requests is handled in the
+                  // HttpResponseInterceptor
+
                  this.notificationService.alert({
                    title: $localize`Oops! Incorrect Security Token.`
                  });
+                }

                return EMPTY;
              }),
--- a/apps/client/src/app/core/http-response.interceptor.ts
+++ b/apps/client/src/app/core/http-response.interceptor.ts
@ -98,15 +98,23 @@ export class HttpResponseInterceptor implements HttpInterceptor {
            });
          }
        } else if (error.status === StatusCodes.TOO_MANY_REQUESTS) {
-          if (!this.snackBarRef) {
-            this.snackBarRef = this.snackBar.open(
-              $localize`Oops! It looks like you’re making too many requests. Please slow down a bit.`
+          // Replace an already visible snack bar so that the rate limiting
+          // feedback is not swallowed
+          const snackBarRef = this.snackBar.open(
+            $localize`Oops! It looks like you’re making too many requests. Please slow down a bit.`,
+            undefined,
+            {
+              duration: ms('6 seconds')
+            }
          );

-            this.snackBarRef?.afterDismissed().subscribe(() => {
+          snackBarRef.afterDismissed().subscribe(() => {
+            if (this.snackBarRef === snackBarRef) {
              this.snackBarRef = undefined;
-            });
            }
+          });
+
+          this.snackBarRef = snackBarRef;
        } else if (error.status === StatusCodes.UNAUTHORIZED) {
          if (!error.url?.includes('/data-providers/ghostfolio/status')) {
            if (this.webAuthnService.isEnabled()) {
--- a/libs/common/src/lib/config.ts
+++ b/libs/common/src/lib/config.ts
@ -329,4 +329,9 @@ export const TAG_ID_EXCLUDE_FROM_ANALYSIS =
  'f2e868af-8333-459f-b161-cbc6544c24bd';
 export const TAG_ID_DEMO = 'efa08cb3-9b9d-4974-ac68-db13a19c4874';

+export const THROTTLE_DEFAULT_LIMIT = 10;
+export const THROTTLE_DEFAULT_TTL = ms('1 minute');
+export const THROTTLE_SIGNUP_LIMIT = 5;
+export const THROTTLE_SIGNUP_TTL = ms('1 hour');
+
 export const UNKNOWN_KEY = 'UNKNOWN';
--- a/package-lock.json
+++ b/package-lock.json
@ -29,6 +29,7 @@
        "@internationalized/number": "3.6.7",
        "@ionic/angular": "8.8.12",
        "@keyv/redis": "5.1.6",
+        "@nest-lab/throttler-storage-redis": "1.2.0",
        "@nestjs/bull": "11.0.4",
        "@nestjs/cache-manager": "3.1.3",
        "@nestjs/common": "11.1.27",
@ -40,6 +41,7 @@
        "@nestjs/platform-express": "11.1.27",
        "@nestjs/schedule": "6.1.3",
        "@nestjs/serve-static": "5.0.5",
+        "@nestjs/throttler": "6.5.0",
        "@openrouter/ai-sdk-provider": "2.9.1",
        "@prisma/adapter-pg": "7.8.0",
        "@prisma/client": "7.8.0",
@ -6956,6 +6958,39 @@
        "tslib": "^2.4.0"
      }
    },
+    "node_modules/@nest-lab/throttler-storage-redis": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/@nest-lab/throttler-storage-redis/-/throttler-storage-redis-1.2.0.tgz",
+      "integrity": "sha512-tMkUyo68NCKTR+zILk+EC35SMYBtDPZY2mCj7ZaCietWGVTnuP4zwq9ERYfvU6kJv6h8teNZrC6MJCmY6/dljw==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.3.0"
+      },
+      "peerDependencies": {
+        "@nestjs/common": "^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0",
+        "@nestjs/core": "^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0",
+        "@nestjs/throttler": ">=6.0.0",
+        "ioredis": ">=5.0.0",
+        "reflect-metadata": "^0.2.1"
+      },
+      "peerDependenciesMeta": {
+        "@nestjs/common": {
+          "optional": false
+        },
+        "@nestjs/core": {
+          "optional": false
+        },
+        "@nestjs/throttler": {
+          "optional": false
+        },
+        "ioredis": {
+          "optional": false
+        },
+        "reflect-metadata": {
+          "optional": false
+        }
+      }
+    },
    "node_modules/@nestjs/bull": {
      "version": "11.0.4",
      "resolved": "https://registry.npmjs.org/@nestjs/bull/-/bull-11.0.4.tgz",
@ -7441,6 +7476,17 @@
        }
      }
    },
+    "node_modules/@nestjs/throttler": {
+      "version": "6.5.0",
+      "resolved": "https://registry.npmjs.org/@nestjs/throttler/-/throttler-6.5.0.tgz",
+      "integrity": "sha512-9j0ZRfH0QE1qyrj9JjIRDz5gQLPqq9yVC2nHsrosDVAfI5HHw08/aUAWx9DZLSdQf4HDkmhTTEGLrRFHENvchQ==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@nestjs/common": "^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0",
+        "@nestjs/core": "^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0",
+        "reflect-metadata": "^0.1.13 || ^0.2.0"
+      }
+    },
    "node_modules/@ngtools/webpack": {
      "version": "21.2.6",
      "resolved": "https://registry.npmjs.org/@ngtools/webpack/-/webpack-21.2.6.tgz",
--- a/package.json
+++ b/package.json
@ -73,6 +73,7 @@
    "@internationalized/number": "3.6.7",
    "@ionic/angular": "8.8.12",
    "@keyv/redis": "5.1.6",
+    "@nest-lab/throttler-storage-redis": "1.2.0",
    "@nestjs/bull": "11.0.4",
    "@nestjs/cache-manager": "3.1.3",
    "@nestjs/common": "11.1.27",
@ -84,6 +85,7 @@
    "@nestjs/platform-express": "11.1.27",
    "@nestjs/schedule": "6.1.3",
    "@nestjs/serve-static": "5.0.5",
+    "@nestjs/throttler": "6.5.0",
    "@openrouter/ai-sdk-provider": "2.9.1",
    "@prisma/adapter-pg": "7.8.0",
    "@prisma/client": "7.8.0",