Throttle TOTP requests

.env.example

@@ -210,6 +210,7 @@ LOGIN_AUTOCOMPLETE=false
 RESET_PASSWORD_LINK_EXPIRES=15
 PASSWORD_CONFIRM_TIMEOUT=10800
 PASSWORD_RESET_MAX_ATTEMPTS_PER_MIN=50
+TWO_FACTOR_MAX_ATTEMPTS_PER_MIN=5
 INVITE_PASSWORD_LINK_EXPIRES=1500
 
 # --------------------------------------------

app/Providers/RouteServiceProvider.php

@@ -103,5 +103,11 @@ class RouteServiceProvider extends ServiceProvider
             return Limit::perMinute(config('auth.password_reset.max_attempts_per_min'))->by(optional($request->user())->id ?: $request->ip());
         });
 
+        // Rate limiter for two-factor authentication — keyed on user ID since the user is already
+        // password-authenticated at this stage, preventing distributed brute force across IPs.
+        RateLimiter::for('two_factor', function (Request $request) {
+            return Limit::perMinute(config('auth.two_factor.max_attempts_per_min'))->by(optional($request->user())->id ?: $request->ip());
+        });
+
     }
 }

config/auth.php

@@ -122,6 +122,10 @@ return [
         'max_attempts_per_min' => env('PASSWORD_RESET_MAX_ATTEMPTS_PER_MIN', 50),
     ],
 
+    'two_factor' => [
+        'max_attempts_per_min' => env('TWO_FACTOR_MAX_ATTEMPTS_PER_MIN', 5),
+    ],
+
     /*
     |--------------------------------------------------------------------------
     | Password Confirmation Timeout

routes/web.php

@@ -655,7 +655,7 @@ Route::group(['middleware' => 'web'], function () {
     Route::post(
         'two-factor',
         [LoginController::class, 'postTwoFactorAuth']
-    );
+    )->middleware('throttle:two_factor');
 
     Route::post(
         'password/email',