SH103: No rate limiting on authentication routes

Severity: medium · Category: authentication · Applies to: express

Why it matters

Without rate limiting, login and password routes can be brute-forced.

How to fix

Add express-rate-limit (or similar) to the login, register and reset routes.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH103

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH103