feat: Add rate limiter #1976
feat: Add rate limiter #1976
Conversation
Codecov Report
@@ Coverage Diff @@
## master #1976 +/- ##
==========================================
+ Coverage 78.10% 78.27% +0.16%
==========================================
Files 71 72 +1
Lines 8611 8667 +56
==========================================
+ Hits 6726 6784 +58
+ Misses 1885 1883 -2
Flags with carried forward coverage won't be shown. Click here to find out more.
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. |
This allows regulation of the number of times a user can request a particular API or view given a time-frame. It protects against brute-forcing entry and denial of service.
|
@dpgaspar ptl, i have addressed your comments and fixed the linting (can I suggest using a newer flake8, the one used here is really really old). |
|
Hi @dpgaspar PR is finished. Would be great if it was included in 4.2.1 :-) |
|
sorry, it won't, but I'll make a 4.3.0 next week just for this, no worries |
|
awesome, that'll work :-) |
| @@ -255,6 +257,10 @@ def __init__(self, appbuilder): | |||
| app.config.setdefault("AUTH_LDAP_LASTNAME_FIELD", "sn") | |||
| app.config.setdefault("AUTH_LDAP_EMAIL_FIELD", "mail") | |||
|
|
|||
| # Rate limiting | |||
| app.config.setdefault("AUTH_RATE_LIMITED", True) | |||
| app.config.setdefault("AUTH_RATE_LIMIT", "2 per 5 second") | |||
There was a problem hiding this comment.
This seems a bit agressive, what do you think about keeping the same rate but increasing the number of attempts needed. Example: "10 per 25 second"?
There was a problem hiding this comment.
I don't think it's aggressive. A human being will have trouble meeting this if they have to retype the password and otherwise a short pause won't hurt. An automated system configured wrongly will remain wrong.
So if you realize "omg ive typed in the password/username twice" you probably start thinking a bit longer and cross the 5s barrier (try it!) and if you do make it a slight pause won't hurt IMHO.
An alternative is to redirect to a captcha when reaching the limit but I'll leave that to someone else.
Anyways I'm not married to this limit but I do not think it's too aggressive.
There was a problem hiding this comment.
I was able to reach it pretty easily and manually
There was a problem hiding this comment.
Easily as in normal human behavior or as in trying to trigger it? Triple entry isn't common.
But if you think it's better we can switch.
There was a problem hiding this comment.
Trying to trigger it, but If you agree, I think it would be more conservative and still safe against brute force and DoS
FAB 4.3.0 added rate limiting and we would like to upgrade to this version. This requires to bring some of the changes from the PRs merged in Flask App Builder: * dpgaspar/Flask-AppBuilder#1976 * dpgaspar/Flask-AppBuilder#1997 * dpgaspar/Flask-AppBuilder#1999 While Flask App Builder disabled rate limitig by default, Airlfow is "end product" using it and we decided to enable it.
FAB 4.3.0 added rate limiting and we would like to upgrade to this version. This requires to bring some of the changes from the PRs merged in Flask App Builder: * dpgaspar/Flask-AppBuilder#1976 * dpgaspar/Flask-AppBuilder#1997 * dpgaspar/Flask-AppBuilder#1999 While Flask App Builder disabled rate limitig by default, Airlfow is "end product" using it and we decided to enable it.
FAB 4.3.0 added rate limiting and we would like to upgrade to this version. This requires to bring some of the changes from the PRs merged in Flask App Builder: * dpgaspar/Flask-AppBuilder#1976 * dpgaspar/Flask-AppBuilder#1997 * dpgaspar/Flask-AppBuilder#1999 While Flask App Builder disabled rate limitig by default, Airlfow is "end product" using it and we decided to enable it. GitOrigin-RevId: b7f05008ae45fc208456f7f64c19d08ad1cf7313
FAB 4.3.0 added rate limiting and we would like to upgrade to this version. This requires to bring some of the changes from the PRs merged in Flask App Builder: * dpgaspar/Flask-AppBuilder#1976 * dpgaspar/Flask-AppBuilder#1997 * dpgaspar/Flask-AppBuilder#1999 While Flask App Builder disabled rate limitig by default, Airlfow is "end product" using it and we decided to enable it. GitOrigin-RevId: b7f05008ae45fc208456f7f64c19d08ad1cf7313
Description
This allows regulation of the number of times a user can request a particular API or view given a time-frame. It protects against brute-forcing entry and denial of service.
Both Airflow and Superset have a long standing issue of not being able to rate limit access to APIs and views allowing for brute forcing access.
apache/superset#10560
https://lists.apache.org/thread/hdpyr3y5cq0djcogn1ql7gj7vq09xo0j
apache/superset#10620
This change allows users to decorate their APIs and Views with
@limit.Note I have turned to default to be ON for authentication for AuthDB and AuthLDAP (Oauth/oidc have their own protection mechanisms) as FAB should be secure out of the box I assume.
cc @potiuk
ADDITIONAL INFORMATION