fix(login): rate limiter shouldn't count successful logins #3141
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jsjoeio
changed the title
jsjoeio
commented
Apr 15, 2021
oxy
suggested changes
Apr 16, 2021
jsjoeio
force-pushed
the
jsjoeio/fix-login-rate-limiter
branch
from
0d5f223
to
fc85bf1
Compare
code-asher
reviewed
Apr 19, 2021
oxy
previously requested changes
Apr 19, 2021
Before, we weren't checking if a login was successful before counting it against the rate limiter. With this change, we only count unsuccessful logins against the rate limiter. We did this because this was a bug but also because it caused problems with our e2e tests hitting the rate limit.
This changes adds a new method called `.canTry` to the rate limiter to check if there are tokens remaining in the bucket. It also adds suggestions from @oxy to make sure the user can brute force past the rate limiter.
jsjoeio
force-pushed
the
jsjoeio/fix-login-rate-limiter
branch
from
fc85bf1
to
7928dc2
Compare
code-asher
approved these changes
Apr 19, 2021
jsjoeio
force-pushed
the
jsjoeio/fix-login-rate-limiter
branch
from
d23c37c
to
f80d5c3
Compare
jsjoeio
dismissed
oxy’s stale review
I've made the requested changed and Asher has approved.
jsjoeio
added
the
merge when passing
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR fixes the login rate limiter to not count successful logins. This is important because it was causing issues with the e2e tests hitting the rate limit even though the logins were successful.
Changes
RateLimiterloginPage.test.tsintologin.test.tsRateLimiter.canTry()to check remaining tokensFixes #2647