heartles/egirlskey
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity

merge: rate limit all password checks - fixes #540 (!568)

Browse source 
View MR for information: https://activitypub.software/TransFem-org/Sharkey/-/merge_requests/568

Closes #540

Approved-by: Marie <marie@kaifa.ch>
Approved-by: Tess K <me@thvxl.se>
This commit is contained in:
dakkar 2024-07-29 10:47:33 +00:00
commit ad9848acfa
8 changed files with 56 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
packages/backend/src/server/api/endpoints/i/2fa/key-done.ts
View file

@ -14,12 +14,19 @@ import type { UserProfilesRepository, UserSecurityKeysRepository } from '@/model
import { WebAuthnService } from '@/core/WebAuthnService.js';
import { ApiError } from '@/server/api/error.js';
import { UserAuthService } from '@/core/UserAuthService.js';
import ms from 'ms';
export const meta = {
requireCredential: true,
secure: true,
limit: {
duration: ms('1hour'),
max: 10,
minInterval: ms('1sec'),
},
errors: {
incorrectPassword: {
message: 'Incorrect password.',

7
packages/backend/src/server/api/endpoints/i/2fa/register-key.ts
View file

@ -12,12 +12,19 @@ import { DI } from '@/di-symbols.js';
import { WebAuthnService } from '@/core/WebAuthnService.js';
import { ApiError } from '@/server/api/error.js';
import { UserAuthService } from '@/core/UserAuthService.js';
import ms from 'ms';
export const meta = {
requireCredential: true,
secure: true,
limit: {
duration: ms('1hour'),
max: 10,
minInterval: ms('1sec'),
},
errors: {
userNotFound: {
message: 'User not found.',

7
packages/backend/src/server/api/endpoints/i/2fa/register.ts
View file

@ -14,12 +14,19 @@ import { DI } from '@/di-symbols.js';
import type { Config } from '@/config.js';
import { ApiError } from '@/server/api/error.js';
import { UserAuthService } from '@/core/UserAuthService.js';
import ms from 'ms';
export const meta = {
requireCredential: true,
secure: true,
limit: {
duration: ms('1hour'),
max: 10,
minInterval: ms('1sec'),
},
errors: {
incorrectPassword: {
message: 'Incorrect password.',

7
packages/backend/src/server/api/endpoints/i/2fa/remove-key.ts
View file

@ -13,10 +13,17 @@ import { GlobalEventService } from '@/core/GlobalEventService.js';
import { DI } from '@/di-symbols.js';
import { ApiError } from '@/server/api/error.js';
import { UserAuthService } from '@/core/UserAuthService.js';
import ms from 'ms';
export const meta = {
requireCredential: true,
limit: {
duration: ms('1hour'),
max: 10,
minInterval: ms('1sec'),
},
secure: true,
errors: {

7
packages/backend/src/server/api/endpoints/i/2fa/unregister.ts
View file

@ -13,12 +13,19 @@ import { GlobalEventService } from '@/core/GlobalEventService.js';
import { DI } from '@/di-symbols.js';
import { ApiError } from '@/server/api/error.js';
import { UserAuthService } from '@/core/UserAuthService.js';
import ms from 'ms';
export const meta = {
requireCredential: true,
secure: true,
limit: {
duration: ms('1hour'),
max: 10,
minInterval: ms('1sec'),
},
errors: {
incorrectPassword: {
message: 'Incorrect password.',

7
packages/backend/src/server/api/endpoints/i/change-password.ts
View file

@ -10,10 +10,17 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
import type { UserProfilesRepository } from '@/models/_.js';
import { DI } from '@/di-symbols.js';
import { UserAuthService } from '@/core/UserAuthService.js';
import ms from 'ms';
export const meta = {
requireCredential: true,
limit: {
duration: ms('1hour'),
max: 10,
minInterval: ms('1sec'),
},
secure: true,
} as const;

7
packages/backend/src/server/api/endpoints/i/delete-account.ts
View file

@ -11,10 +11,17 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
import { DeleteAccountService } from '@/core/DeleteAccountService.js';
import { DI } from '@/di-symbols.js';
import { UserAuthService } from '@/core/UserAuthService.js';
import ms from 'ms';
export const meta = {
requireCredential: true,
limit: {
duration: ms('1hour'),
max: 10,
minInterval: ms('1sec'),
},
secure: true,
} as const;

7
packages/backend/src/server/api/endpoints/i/regenerate-token.ts
View file

@ -11,10 +11,17 @@ import type { UsersRepository, UserProfilesRepository } from '@/models/_.js';
import generateUserToken from '@/misc/generate-native-user-token.js';
import { GlobalEventService } from '@/core/GlobalEventService.js';
import { DI } from '@/di-symbols.js';
import ms from 'ms';
export const meta = {
requireCredential: true,
limit: {
duration: ms('1hour'),
max: 10,
minInterval: ms('1sec'),
},
secure: true,
} as const;