Skip to content

Rate-limit the public event tracking endpoint #552

Description

@phertyameen

Description

Apply rate limiting to POST /analytics/events/track (referencing the approach from issue #313, Request Rate Limiting Middleware) so a single client can't flood the ingestion pipeline.

Why this matters

A client-facing tracking endpoint is a natural target for abuse or accidental event storms from a buggy frontend build.

Files to touch

  • backend/src/analytics/analytics.controller.ts

Acceptance Criteria

  • Requests over the limit receive a 429 with a Retry-After header
  • Rate limit is scoped per-IP or per-user, not global

Notes

This issue is part of the new analytics module effort (tracking, aggregation,
and reporting on player/game activity). Please keep new code inside
backend/src/analytics/ following the same module/controller/service/provider
layout used by existing modules (e.g. progress, streak, quests).

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions