Skip to content
This repository has been archived by the owner on Sep 10, 2024. It is now read-only.

Add rate-limiting for account recovery and registration #3093

Merged
merged 4 commits into from
Aug 7, 2024

Conversation

reivilibre
Copy link
Contributor

@reivilibre reivilibre commented Aug 7, 2024

Follows #3090

Fixes #2992
Fixes #2541

@reivilibre reivilibre requested a review from sandhose August 7, 2024 17:41
Copy link

cloudflare-workers-and-pages bot commented Aug 7, 2024

Deploying matrix-authentication-service-docs with  Cloudflare Pages  Cloudflare Pages

Latest commit: fcf68f6
Status: ✅  Deploy successful!
Preview URL: https://452668df.matrix-authentication-service-docs.pages.dev
Branch Preview URL: https://rei-rl-registration.matrix-authentication-service-docs.pages.dev

View logs

crates/config/src/sections/rate_limiting.rs Outdated Show resolved Hide resolved
crates/handlers/src/rate_limit.rs Outdated Show resolved Hide resolved
@@ -130,14 +132,25 @@ pub(crate) async fn post(
// Verify the CSRF token
let () = cookie_jar.verify_form(&clock, form)?;

// Check the rate limit if we are about to process the form
if let Err(e) = limiter.check_account_recovery(requester, &recovery_session.email) {
tracing::warn!(error = &e as &dyn std::error::Error);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I really wish tracing had a sigil (like ? or %) to report as &dyn Error :(

Copy link
Contributor Author

@reivilibre reivilibre Aug 7, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you're not alone: tokio-rs/tracing#1308

@reivilibre reivilibre enabled auto-merge (squash) August 7, 2024 17:56
@reivilibre reivilibre merged commit 5d4a4a6 into main Aug 7, 2024
13 checks passed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Rate-limit sending of e-mails Rate-limit password-based logins and registrations
2 participants