DocsDeveloper SectionSecurity and Rate Limiting

🛡️ Backend Security and Rate Limiting

The Medusa backend authentication system (Auth) is equipped with one of the most advanced Rate Limiting mechanisms to prevent cyber attacks and financial losses.

Common E-Commerce Vulnerabilities

Online stores that use mobile login (SMS OTP) are generally exposed to two serious attacks:

SMS Bombing: Bots trigger thousands of SMS messages by sending repeated requests to the API, draining your SMS panel credit.
Brute-Force: Hackers attempt to access users' accounts by repeatedly guessing the OTP code or password.

Smart `countOn` Strategy in Medusa Middlewares

To counter these attacks, a dedicated RateLimiter is implemented in the store-admin/src/api/middlewares.ts file. Instead of blindly blocking IPs, it behaves smartly based on the success/failure status of the request:

countOn Strategy: 'success'

Used in SMS sending requests (Phone Auth)

The system only increments the counter when an SMS is successfully sent (2xx code). This prevents innocent users who encounter 4xx network errors from being penalized and blocked. (Limit: 3 sends per hour)

countOn Strategy: 'failure'

Used in password / OTP entry

During login, the counter only increments when an incorrect password is entered (4xx error). This means a successful and normal login never causes rate limiting, but a bot trying to guess is quickly blocked. (Limit: 5 incorrect guesses per 30 minutes)

store-admin/src/api/middlewares.ts (Rate Limiting Section)

typescript

// ── OTP request: phone (POST /auth/customer/phone-auth) ───────────────
{
  method: "POST",
  matcher: "/auth/customer/phone-auth",
  middlewares: [
    createRateLimitMiddleware({
      maxAttempts: 3,
      windowMs: 60 * 60 * 1000, // 1 hour
      countOn: "success",        // only count actual OTP sends
      message: "Too many OTP requests. Please try again later.",
    }),
  ],
},
// ── OTP register: phone ───────────────────────────────────────────────
{
  method: "POST",
  matcher: "/auth/customer/phone-register",
  middlewares: [
    createRateLimitMiddleware({
      maxAttempts: 5,
      windowMs: 30 * 60 * 1000, // 30 minutes
      countOn: "failure",        // only penalize wrong codes
      message: "Too many failed attempts. Please try again later.",
    }),
  ],
},

Using Redis

The status and number of requests for each IP are stored in ultra-fast Redis memory (in the Docker container) so that even with high server traffic, the validation process is performed with Zero Latency.