Use custom rate limiter when asking verif email

2 files changed, 11 insertions, 1 deletions

diff --git a/server/controllers/api/users/index.ts b/server/controllers/api/users/index.ts
index 008c34ca4..01ee73a53 100644
--- a/server/controllers/api/users/index.ts
+++ b/server/controllers/api/users/index.ts
@@ -42,6 +42,12 @@ const loginRateLimiter = new RateLimit({
   delayMs: 0
 })
 
+const askSendEmailLimiter = new RateLimit({
+  windowMs: RATES_LIMIT.ASK_SEND_EMAIL.WINDOW_MS,
+  max: RATES_LIMIT.ASK_SEND_EMAIL.MAX,
+  delayMs: 0
+})
+
 const usersRouter = express.Router()
 usersRouter.use('/', meRouter)
 
@@ -114,7 +120,7 @@ usersRouter.post('/:id/reset-password',
 )
 
 usersRouter.post('/ask-send-verify-email',
-  loginRateLimiter,
+  askSendEmailLimiter,
   asyncMiddleware(usersAskSendVerifyEmailValidator),
   asyncMiddleware(askSendVerifyUserEmail)
 )
diff --git a/server/initializers/constants.ts b/server/initializers/constants.ts
index 16d8dca68..536d99713 100644
--- a/server/initializers/constants.ts
+++ b/server/initializers/constants.ts
@@ -364,6 +364,10 @@ const RATES_LIMIT = {
   LOGIN: {
     WINDOW_MS: 5 * 60 * 1000, // 5 minutes
     MAX: 15 // 15 attempts
+  },
+  ASK_SEND_EMAIL: {
+    WINDOW_MS: 5 * 60 * 1000, // 5 minutes
+    MAX: 3 // 3 attempts
   }
 }