{
  "id": 6856711,
  "title": "Hardening a SaaS login on Cloudflare Free: Turnstile, Google sign-in and email without SMTP",
  "url": "https://urgent.news/2026/09/12/hardening-a-saas-login-on-cloudflare-free-turnstile-google-sign-in",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-12T03:55:00.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/alexandroskyv/hardening-a-saas-login-on-cloudflare-free-turnstile-google-sign-in-and-email-without-smtp-1lh"
  },
  "original_language": "en",
  "account": "SyllogOS, a multi-tenant platform being built for Greek cultural associations, utilizes Cloudflare's Free plan and one VPS to secure its login process. The login flow consists of several layers, each assuming the previous one has failed:\n\n1. At the edge, a rate limit is implemented, allowing only three requests per IP within a 10-second timeframe. If exceeded, the request is blocked for 10 seconds. This measure is not foolproof and is intended to serve as a deterrent.\n2. The real client IP is essential for accurate rate limiting. To achieve this, nginx is configured to trust specific Cloudflare IP ranges, ensuring that the visitor's actual IP is used for subsequent checks. This allows for precise rate limiting without falsely blocking legitimate users.\n3. Cloudflare's Turnstile service replaces traditional CAPTCHAs with an invisible verification system. Upon successful verification, a single-use token is sent to the server for authentication. The server must verify this token to grant access, ensuring that bots cannot bypass the verification process.\n4. An application limiter is placed within the API, limiting the number of login attempts to 10 per minute. If exceeded, the client is locked out for 10 minutes. This layer remains functional even if the Cloudflare rate limit is altered or bypassed.\n5. Google sign-in is integrated without requiring Google to build protection mechanisms. Members are added by tenant administrators, and upon successful Google sign-in, the user's email address is verified against the tenant's records.\n6. For email notifications, the platform utilizes a transactional email API (Resend) instead of SMTP, as the VPS provider blocks outbound mail ports. Emails are sent over HTTPS, ensuring secure communication without relying on SMTP infrastructure.",
  "summary": "SyllogOS is a multi-tenant platform I'm building for Greek cultural associations and the federations they belong to: members, boards, events, documents. Its first tenant is a regional federation, and the people logging in are volunteers, not engineers. That shaped the login more than any threat model. It has to be safe, and it has to feel safe to someone who has never heard the word \"brute…",
  "key_points": [
    "Cloudflare Free plan secures multi-tenant SaaS login on VPS",
    "Turnstile replaces CAPTCHAs with invisible verification system",
    "Email notifications use transactional API (Resend) instead of SMTP"
  ],
  "editors_take": "This layered approach to securing a SaaS login on Cloudflare Free significantly raises the bar for would-be attackers, making it harder for them to gain unauthorized access through various means.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}