No rate limiting on auth endpoints (login/signup/reset)

p5.js version

No response

What is your operating system?

None

Web browser and version

No response

Actual Behavior

Auth routes currently accept unlimited requests. There’s no throttling/cooldown behavior, so brute force and spam are trivial

Affected routes:

• POST /editor/login
• POST /editor/signup
• GET /editor/signup/duplicate_check
• POST /editor/reset-password
• POST /editor/reset-password/:token

Expected behavior:
After a threshold, API should return 429 Too Many Requests (or equivalent lockout/backoff)

Actual behavior:
Requests continue indefinitely with no throttling

Why this matters:

-Brute-force login attempts are not slowed down.
-Signup/reset flows can be abused for spam and account enumeration.
-This is a security gap, not just optimization.

Environment:
Repo: processing/p5.js-web-editor
Date observed: 2026-02-21
Local dev setup on Windows

Steps to reproduce:

1. Send repeated requests to POST /editor/login with bad credentials in a loop.
2. Repeat rapidly (100+ requests).
3. Observe responses

Start by reproducing the issue against the listed auth entry points: POST /editor/login, POST /editor/signup, GET /editor/signup/duplicate_check, and the reset-password routes. Trace those routes to their implementations and define the threshold and backoff behavior; done means excessive requests receive 429 or an equivalent lockout, while normal requests continue to work.