[FEAT] 3 updates to auth api #3123

Problem Statement

1. Rate-limit only auth POST actions like signin / callback, not every POST. Otherwise signout, session, etc. can also get blocked.
2. Use redirect status 303 for a POST redirect, so the browser follows with a GET request.
3. Do not rely on Map for production rate limiting if deployed on serverless/multiple instances. It is only in-memory per running function instance; use Redis/Upstash/Vercel KV for real production protection. Vercel Functions scale by invocation/instance, so memory is not a global shared store.

Proposed Solution

import NextAuth from "next-auth";
import { authOptions } from "@/lib/auth";
import { NextRequest, NextResponse } from "next/server";

const handler = NextAuth(authOptions);

const rateLimitMap = new Map<string, { count: number; resetAt: number }>();

const RATE_LIMIT_MAX = 10;
const RATE_LIMIT_WINDOW_MS = 60 * 1000;

type AuthRouteContext = {
params: Promise<{ nextauth: string[] }>;
};

function getClientIP(req: NextRequest): string {
return (
req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ||
req.headers.get("x-real-ip") ||
"unknown"
);
}

function isRateLimited(ip: string): boolean {
const now = Date.now();

const entry = rateLimitMap.get(ip);

if (!entry || now > entry.resetAt) {
rateLimitMap.set(ip, {
count: 1,
resetAt: now + RATE_LIMIT_WINDOW_MS,
});

return false;

}

if (entry.count >= RATE_LIMIT_MAX) {
return true;
}

entry.count += 1;
return false;
}

export async function GET(req: NextRequest, ctx: AuthRouteContext) {
const params = await ctx.params;
return handler(req, { params });
}

export async function POST(req: NextRequest, ctx: AuthRouteContext) {
const params = await ctx.params;
const action = params.nextauth?.[0];

const shouldRateLimit = action === "signin" || action === "callback";

if (shouldRateLimit) {
const ip = getClientIP(req);

if (isRateLimited(ip)) {
  return NextResponse.redirect(
    new URL("/auth/signin?error=RateLimitError", req.url),
    { status: 303 }
  );
}

}

return handler(req, { params });
}

Feature Area

Authentication

Alternatives Considered

No response

Acceptance Criteria

• ...
• ...

Additional Context

No response