mirror of
https://github.com/Cockatrice/Cockatrice.git
synced 2026-09-23 10:05:10 -07:00
b2f63255f0
Introduce a thread-safe RateLimiter that tracks attempts per key (IP address) within a sliding time window, and wire it into the authentication endpoints: - Login: failed login attempts from an address are counted; once the configured maximum is exceeded within the window, further logins from that address are rejected with RespTooManyRequests. A successful login clears the failed attempts for that address. - Registration: implement the previously stubbed tooManyRegistrationAttempts, limiting how many accounts can be created per address per window. - Forgot-password: throttle both the email-request and the email-challenge paths per address. New [security] settings with defaults: max_login_attempts_per_ip=5 / login_attempt_window_seconds=900 max_registrations_per_ip=2 / registration_window_seconds=3600 max_forgot_password_requests_per_ip=3 / forgot_password_window_seconds=3600 Adds unit tests for the RateLimiter (window limit, over-limit blocking, clearing, per-key independence). Took 3 minutes |
||
|---|---|---|
| .. | ||
| game | ||
| CMakeLists.txt | ||
| room_message_type.h | ||
| server.cpp | ||
| server.h | ||
| server_abstractuserinterface.cpp | ||
| server_abstractuserinterface.h | ||
| server_database_interface.cpp | ||
| server_database_interface.h | ||
| server_player_reference.h | ||
| server_protocolhandler.cpp | ||
| server_protocolhandler.h | ||
| server_remoteuserinterface.cpp | ||
| server_remoteuserinterface.h | ||
| server_response_containers.cpp | ||
| server_response_containers.h | ||
| server_room.cpp | ||
| server_room.h | ||
| serverinfo_user_container.cpp | ||
| serverinfo_user_container.h | ||
| user_level.h | ||