# Duplicate account creation is difficult

- **Pattern:** `ab-000707` (`community-moderation-safety.spam-prevention.duplicate-accounts`)
- **Severity:** medium
- **Lifecycle:** active
- **Last modified:** 2026-04-18
- **Canonical URL:** https://auditbuffet.com/patterns/ab-000707
- **License:** CC-BY-4.0 — attribute to AuditBuffet Pattern Catalog (https://auditbuffet.com/patterns/ab-000707)

## Why it matters

When a single IP can create unlimited accounts, bans become meaningless — a banned user creates a fresh account and resumes immediately. CWE-799 applies: without account-creation rate limiting, the enforcement system is trivially circumvented. Beyond ban evasion, unrestricted signup enables large-scale coordinated behavior: sock puppet networks, fake review farms, and artificially inflated user counts that distort analytics and business decisions. Platforms without IP-level account limits also bear the database and email delivery cost of every throwaway account created during attacks.

## Severity rationale

Medium because duplicate account creation directly enables ban evasion and coordinated inauthentic behavior, but requires attacker effort and does not expose existing user data.

## Remediation

Apply IP-based rate limiting to the signup endpoint in `src/app/api/auth/signup/route.ts`:

```typescript
import rateLimit from 'express-rate-limit';

export const signupLimiter = rateLimit({
  windowMs: 60 * 60 * 1000, // 1 hour
  max: 5,                   // 5 accounts per IP per hour
  keyGenerator: (req) => req.ip,
  message: 'Too many accounts created from this IP. Try again later.',
});
```

For higher-assurance requirements, add phone verification (Twilio Verify or similar) as a second factor on signup. This raises the cost of duplicate account creation from zero to per-number SMS pricing.

## Detection

- **ID:** `duplicate-accounts`
- **Severity:** `medium`
- **What to look for:** Check for protections against creating multiple accounts per user/IP. Look for rate limiting on account creation, IP-based account limits, or phone verification. Check if banned users can easily create new accounts.
- **Pass criteria:** Account creation is rate-limited to no more than 5 accounts per IP per hour, or requires phone verification. Count the number of anti-duplicate-account mechanisms present (rate limiting, phone verification, IP tracking). Banned users face friction to create new accounts (e.g., different IP, payment method). Quote the actual rate-limit configuration values from code.
- **Fail criteria:** No friction. One IP can create unlimited accounts. Banned users can instantly create a new account and resume posting.
- **Skip (N/A) when:** Platform has fewer than 100 active users and minimal spam pressure.
- **Detail on fail:** `"No rate limiting on signup. A single IP can create 100+ accounts in seconds."`
- **Remediation:** Implement rate limiting on account creation per IP address at `src/api/auth/signup/route.ts`:

  ```javascript
  const signupLimiter = rateLimit({
    windowMs: 60 * 60 * 1000, // 1 hour
    max: 5,
    keyGenerator: (req) => req.ip,
    message: 'Too many accounts created from this IP.'
  });
  ```

## External references

- cwe CWE-799

Taxons: access-control, cost-efficiency

HTML version: https://auditbuffet.com/patterns/ab-000707