jeirmeister/Cockatrice
1
0
Fork 0
mirror of https://github.com/Cockatrice/Cockatrice.git synced 2026-09-24 10:23:02 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

[Security] Add per-address rate limiting for auth endpoints

Browse source 
Introduce a thread-safe RateLimiter that tracks attempts per key
(IP address) within a sliding time window, and wire it into the
authentication endpoints:

- Login: failed login attempts from an address are counted; once the
  configured maximum is exceeded within the window, further logins
  from that address are rejected with RespTooManyRequests. A
  successful login clears the failed attempts for that address.
- Registration: implement the previously stubbed
  tooManyRegistrationAttempts, limiting how many accounts can be
  created per address per window.
- Forgot-password: throttle both the email-request and the
  email-challenge paths per address.

New [security] settings with defaults:
  max_login_attempts_per_ip=5 / login_attempt_window_seconds=900
  max_registrations_per_ip=2 / registration_window_seconds=3600
  max_forgot_password_requests_per_ip=3 / forgot_password_window_seconds=3600

Adds unit tests for the RateLimiter (window limit, over-limit
blocking, clearing, per-key independence).

Took 3 minutes
This commit is contained in:
Lukas Brübach 2026-08-04 10:38:20 +02:00
parent 1ed9823b56
commit b2f63255f0
11 changed files with 238 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

21
servatrice/servatrice.ini.example
View file

@ -348,6 +348,27 @@ max_users_websocket=500
; Maximum number of users that can connect from the same IP address; useful to avoid bots, default is 4
max_users_per_address=4
; Maximum number of failed login attempts from a single IP address before that
; address is temporarily locked out. Default is 5; set to 0 to disable.
max_login_attempts_per_ip=5
; Length in seconds of the sliding window used for the login lockout. Default is 900 (15 minutes).
login_attempt_window_seconds=900
; Maximum number of account registrations from a single IP address within the window below.
; Default is 2; set to 0 to disable.
max_registrations_per_ip=2
; Length in seconds of the registration window. Default is 3600 (1 hour).
registration_window_seconds=3600
; Maximum number of forgot-password requests from a single IP address within the window below.
; Default is 3; set to 0 to disable.
max_forgot_password_requests_per_ip=3
; Length in seconds of the forgot-password window. Default is 3600 (1 hour).
forgot_password_window_seconds=3600
; You may want to allow an unlimited number of users from a trusted source. This setting can contain a
; comma-separed list of IP addresses which will allow an unlimited number of connections from each of the
; IP addresses listed (ignoring the max_users_per_address). Default is "127.0.0.1,::1"; example: "192.73.233.244,81.4.100.74"