Repository navigation
Proposal: Add 60-second rate limiting to send-otp function #140
Description
Hey everyone! While I was looking through the send-otp function in functions/send-otp/src/main.js, I noticed there isn't really anything stopping someone from hitting the endpoint repeatedly. This could lead to "OTP bombing" or just waste our API credits pretty quickly.
I’d like to add a 60-second cooldown logic. Basically, the function would check a last_otp_sent timestamp in the database before sending a new one, and return a 429 error if it’s too soon.
I've contributed to the Resonate-Website before and I'm planning to participate in GSoC 2026, so I'd love to help out on the backend side of things now. I've already forked the repo and have a good idea of how to implement this.
@M4dhav, could you please assign this to me so I can get a PR ready?
Activity
M4dhav commentedon Jan 14, 2026
The rate-limit is already enforced on the frontend, the resend-otp button has a timeout of 60 seconds. Do you want to guard against direct requests?
cannonerd007 commentedon Jan 14, 2026
Exactly, @M4dhav. While the frontend timeout handles the user experience, the backend is currently vulnerable to direct API requests (e.g., via Postman or automated scripts).
Implementing this on the backend ensures we protect our API quotas and prevent abuse regardless of where the request originates. It adds that essential 'second layer' of security for production readiness. I'd love to implement this server-side check to make the system more robust.
M4dhav commentedon Jan 14, 2026
sounds good, make sure there's an early exit. Assigning
feat: implement 60s backend rate-limiting for OTP requests (AOSSIE-Or…
cannonerd007 commentedon Jan 15, 2026
I've just submitted a PR for this (#141). I implemented the 60-second cooldown as an early exit at the start of the function and ensured the last_otp_sent timestamp updates in the database.
I'm really enjoying contributing to Resonate and am looking forward to doing more. Please let me know if there are any other backend tasks or issues I can pick up next!
#141
Gallachandana1 commentedon Jan 29, 2026
Thanks for the clarification, mentors!
I see the issue has already been implemented.
I’m preparing for GSoC 2026 and would love to contribute to other backend issues in Resonate.
Please let me know if there’s anything I can pick up next 🙂