Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Throttle password reset requests to 5 every 60 seconds #10180

Merged
merged 2 commits into from
Oct 8, 2021

Conversation

snipe
Copy link
Owner

@snipe snipe commented Oct 8, 2021

This adds password reset form throttling. (5 attempts in 60 seconds). I wish there was a more elegant way to handle this, it currently just shows a generic 429 error page. Something using the error bag in the future would be a little nicer.

https://www.huntr.dev/bounties/59bedd63-2e4d-44e3-b831-abb7085e282d/

Signed-off-by: snipe <snipe@snipe.net>
@snipe
Copy link
Owner Author

snipe commented Oct 8, 2021

@uberbrady @inietov can you sanity check me here and test this out a bit?

@snipe
Copy link
Owner Author

snipe commented Oct 8, 2021

Hm, I'm getting some weird results in my additional testing.

x-ratelimit-limit: 5
retry-after: 2385

It's locking me out for too long.

@uberbrady
Copy link
Collaborator

Poking around in other places where we throttle, is it possible that the second number is "minutes" and thus you're getting 5 attempts per 60 minutes?

You should also be able to 'reset' your throttling status with php artisan cache:clear

Signed-off-by: snipe <snipe@snipe.net>
@snipe snipe merged commit c4856c8 into master Oct 8, 2021
@snipe snipe deleted the fixes/add_rate_limiting_to_forgotten_password branch October 8, 2021 22:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants