Rate limit phone confirmation attempts (LG-5492) #6216
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mitchellhenke
force-pushed
the
mitchellhenke/new-phone-who-throttled-dis
branch
4 times, most recently
from
0ec002b
to
931a048
Compare
changelog: Feature, Account Management, Rate limit phone confirmation attempts
mitchellhenke
force-pushed
the
mitchellhenke/new-phone-who-throttled-dis
branch
from
931a048
to
449b758
Compare
zachmargolis
approved these changes
Apr 18, 2022
Comment on lines
+202
to
+206
| @phone_confirmation_throttle ||= Throttle.for( | ||
| user: current_user, | ||
| throttle_type: :phone_confirmation, | ||
| ) | ||
| end |
There was a problem hiding this comment.
Just to check my understanding:
- this limits attempts by the same logged-in user for any phone
- our rack-attack should limit attempts by IP address to submit this form
So we shouldn't need to worry about different users spamming different phones because the other rule covers it
There was a problem hiding this comment.
Yep, exactly. The OtpRateLimiter will still ensure a specific phone number is not receiving excessive OTPs, and rack-attack places IP rate limits around the routes where OTPs are sent.
mitchellhenke
changed the title
This was referenced Apr 19, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds a per-account rate limit for sending new phone number confirmation OTPs to augment the existing per-phone-number rate limits.