SECURITY: rate limit user/password login

discourse · Sep 25, 2014 · d53e016 · d53e016 · eviltrout · Sep 25, 2014
1 parent ffa11bd
commit d53e016
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/app/controllers/session_controller.rb b/app/controllers/session_controller.rb
@@ -51,6 +51,9 @@ def create
       return
     end
 
+    RateLimiter.new(nil, "login-hr-#{request.remote_ip}", 30, 1.hour).performed!
+    RateLimiter.new(nil, "login-min-#{request.remote_ip}", 6, 1.minute).performed!
+
     params.require(:login)
     params.require(:password)