Hardening a SaaS login on Cloudflare Free: Turnstile, Google sign-in and email without SMTP
SyllogOS is a multi-tenant platform I'm building for Greek cultural associations and the federations they belong to: members, boards, events, documents. Its first tenant is a regional federation, and the people logging in are volunteers, not engineers. That shaped the login more than any threat model. It has to be safe, and it has to feel safe to someone who has never heard the word "brute…
SyllogOS, a multi-tenant platform being built for Greek cultural associations, utilizes Cloudflare's Free plan and one VPS to secure its login process. The login flow consists of several layers, each assuming the previous one has failed:
1. At the edge, a rate limit is implemented, allowing only three requests per IP within a 10-second timeframe. If exceeded, the request is blocked for 10 seconds. This measure is not foolproof and is intended to serve as a deterrent.
2. The real client IP is essential for accurate rate limiting. To achieve this, nginx is configured to trust specific Cloudflare IP ranges, ensuring that the visitor's actual IP is used for subsequent checks. This allows for precise rate limiting without falsely blocking legitimate users.
3. Cloudflare's Turnstile service replaces traditional CAPTCHAs with an invisible verification system. Upon successful verification, a single-use token is sent to the server for authentication. The server must verify this token to grant access, ensuring that bots cannot bypass the verification process.
4. An application limiter is placed within the API, limiting the number of login attempts to 10 per minute. If exceeded, the client is locked out for 10 minutes. This layer remains functional even if the Cloudflare rate limit is altered or bypassed.
5. Google sign-in is integrated without requiring Google to build protection mechanisms. Members are added by tenant administrators, and upon successful Google sign-in, the user's email address is verified against the tenant's records.
6. For email notifications, the platform utilizes a transactional email API (Resend) instead of SMTP, as the VPS provider blocks outbound mail ports. Emails are sent over HTTPS, ensuring secure communication without relying on SMTP infrastructure.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
