Apply Rate Limits to Unprotected Endpoints

[bigtcze]

Description

Several public and system endpoints are currently missing Rate Limiting middleware, making them potential targets for Denial of Service (DoS) attacks.

Unprotected Endpoints identified

1. /api/config: Public endpoint returning frontend configuration. Currently has 0 protection.
2. /api/realtime: Real-time communication endpoint. Needs protection to prevent connection flooding.

Tasks

1. Apply apiLimiter (or a specific publicLimiter with e.g., 60 req/min) to /api/config.
2. Apply apiLimiter to /api/realtime routes.

Note

/api/health should remain unlimited for internal monitoring/Docker healthchecks.

Complexity

Complexity: 1/10