Project Detected: Node.js Express API with JWT authentication and an existing Redis client --- Rate Limits Added: - POST /auth/login: 5 failed attempts per 15 minutes - POST /auth/register: 10 requests per hour - Client IP is used before authentication, with separate keys for each route --- Storage and Scaling: The existing Redis client stores shared counters suitable for multiple application instances. --- Security Controls: - Trusted proxy handling follows the existing reverse-proxy configuration - Rate-limit keys do not contain passwords, tokens, emails, or request bodies - Successful login resets the failed-login counter --- Files Modified: - src/middleware/rateLimits.js - src/routes/auth.js - src/config/env.js - tests/authRateLimits.test.js - .env.example - package.json --- Commands Executed: - npm install rate-limiter-flexible - npm test - npm run lint --- Validation Result: Tests confirmed that normal requests succeed, repeated failed logins return HTTP 429, successful login resets the failure counter, and registration uses a separate limit. --- How to Test: Run npm test, then send repeated invalid login requests to POST /auth/login and confirm that the configured threshold returns HTTP 429. --- Important Notes: Review the default windows against real production traffic before deployment. Redis must be available for consistent limits across multiple application instances.