Repository navigation
feat: add abuse blockers #386
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,118 @@ | ||
| package handlers | ||
|
|
||
| import ( | ||
| "context" | ||
| "crypto/sha256" | ||
| "encoding/hex" | ||
| "fmt" | ||
| "net/http" | ||
| "strconv" | ||
| "strings" | ||
| "time" | ||
|
|
||
| "github.com/labstack/echo/v4" | ||
| "github.com/redis/go-redis/v9" | ||
| ) | ||
|
|
||
| // These throttles use a fixed 60-second-window counter; the simplest | ||
| // useful control. A request in the window increments a per-email counter that | ||
| // expires after the window elapses. | ||
| const ( | ||
| rateLimitWindow = 60 * time.Second | ||
|
|
||
| // signInMaxAttempts allows five sign-in attempts per normalized email per | ||
| // window; the sixth is rejected. This causes at most a short attacker-induced | ||
| // delay, never a permanent account lockout. | ||
| signInMaxAttempts = 5 | ||
|
|
||
| // resetEmailMaxPerWindow sends at most one password-reset email per | ||
| // normalized address per window. | ||
| resetEmailMaxPerWindow = 1 | ||
| ) | ||
|
|
||
| // normalizedEmailRateKey hashes strings.ToLower(strings.TrimSpace(email)) so raw | ||
| // email addresses are never stored in Redis keys. | ||
| func normalizedEmailRateKey(scope, email string) string { | ||
| normalized := strings.ToLower(strings.TrimSpace(email)) | ||
| sum := sha256.Sum256([]byte(normalized)) | ||
| return fmt.Sprintf("ratelimit:%s:%s", scope, hex.EncodeToString(sum[:])) | ||
| } | ||
|
|
||
| // incrementRateLimit increments the counter at key and returns the new count and | ||
| // the TTL remaining on the window. The expiry is set only on the first increment | ||
| // so the window stays anchored to the first request instead of sliding. | ||
| func incrementRateLimit(ctx context.Context, rdb *redis.Client, key string) (int64, time.Duration, error) { | ||
| count, err := rdb.Incr(ctx, key).Result() | ||
| if err != nil { | ||
| return 0, 0, err | ||
| } | ||
| if count == 1 { | ||
| if err := rdb.Expire(ctx, key, rateLimitWindow).Err(); err != nil { | ||
|
Comment on lines
+45
to
+50
There was a problem hiding this comment. 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win Set the counter and expiry atomically. If Use a Redis Lua script or another atomic operation that performs 🤖 Prompt for AI Agents |
||
| return count, 0, err | ||
| } | ||
| return count, rateLimitWindow, nil | ||
| } | ||
| ttl, err := rdb.TTL(ctx, key).Result() | ||
| if err != nil { | ||
| return count, 0, err | ||
| } | ||
| return count, ttl, nil | ||
| } | ||
|
|
||
| // checkSignInRateLimit enforces the per-email sign-in throttle. It fails open | ||
| // (returns nil) when Redis is unavailable. The limiter short-circuits on a nil | ||
| // client, not just on command errors because Turnstile remains active. On the | ||
| // sixth attempt within the window it returns a 429 with a Retry-After header. | ||
| func (h *AuthHandler) checkSignInRateLimit(c echo.Context, email string) error { | ||
| if h.Redis == nil { | ||
| return nil | ||
| } | ||
|
|
||
| key := normalizedEmailRateKey("signin", email) | ||
| count, ttl, err := incrementRateLimit(c.Request().Context(), h.Redis, key) | ||
| if err != nil { | ||
| c.Logger().Errorf("sign-in rate limit: redis error, failing open: %v", err) | ||
| return nil | ||
| } | ||
|
|
||
| if count > signInMaxAttempts { | ||
| retryAfter := int(ttl.Seconds()) | ||
| if retryAfter < 1 { | ||
| retryAfter = 1 | ||
| } | ||
| c.Response().Header().Set("Retry-After", strconv.Itoa(retryAfter)) | ||
| return echo.NewHTTPError(http.StatusTooManyRequests, "Too many sign-in attempts. Please try again later.") | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| // clearSignInRateLimit resets the sign-in counter after a successful login | ||
| func (h *AuthHandler) clearSignInRateLimit(c echo.Context, email string) { | ||
| if h.Redis == nil { | ||
| return | ||
| } | ||
| key := normalizedEmailRateKey("signin", email) | ||
| if err := h.Redis.Del(c.Request().Context(), key).Err(); err != nil { | ||
| c.Logger().Warnf("sign-in rate limit: failed to clear counter: %v", err) | ||
| } | ||
| } | ||
|
|
||
| // allowResetEmail reports whether a password-reset email may be sent to email | ||
| // during the current window. It increments the counter unconditionally (callers | ||
| // must invoke it uniformly, before any user lookup, so behavior and timing don't | ||
| // diverge by account existence) and fails open when Redis is unavailable. | ||
| func (h *AuthHandler) allowResetEmail(c echo.Context, email string) bool { | ||
| if h.Redis == nil { | ||
| return true | ||
| } | ||
|
|
||
| key := normalizedEmailRateKey("reset", email) | ||
| count, _, err := incrementRateLimit(c.Request().Context(), h.Redis, key) | ||
| if err != nil { | ||
| c.Logger().Errorf("reset-email rate limit: redis error, failing open: %v", err) | ||
| return true | ||
| } | ||
|
|
||
| return count <= resetEmailMaxPerWindow | ||
| } | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
Represent the password maximum as a byte limit.
OpenAPI
maxLengthcounts characters, but the backend requirement is 72 UTF-8 bytes. A password with fewer than 72 multibyte characters can pass schema validation and then fail backend validation.Remove the character-based maximum or add a byte-aware contract. State that the maximum is 72 UTF-8 bytes. Regenerate both TypeScript declarations after the change.
Also applies to: 548-549
🧰 Tools
🪛 Checkov (3.3.13)
[high] 1-1814: Ensure that the global security field has rules defined
(CKV_OPENAPI_4)
[high] 1-1814: Ensure that security operations is not empty.
(CKV_OPENAPI_5)
🤖 Prompt for AI Agents