Make LoginRateLimiter case insentive

symfony · May 10, 2021 · eb86bcf · eb86bcf
1 parent a8b5ba8
commit eb86bcf
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 1 deletion.
diff --git a/RateLimiter/DefaultLoginRateLimiter.php b/RateLimiter/DefaultLoginRateLimiter.php
@@ -41,7 +41,7 @@ protected function getLimiters(Request $request): array
     {
         return [
             $this->globalFactory->create($request->getClientIp()),
-            $this->localFactory->create($request->attributes->get(Security::LAST_USERNAME).'-'.$request->getClientIp()),
+            $this->localFactory->create(strtolower($request->attributes->get(Security::LAST_USERNAME)).'-'.$request->getClientIp()),
         ];
     }
 }
diff --git a/Tests/EventListener/LoginThrottlingListenerTest.php b/Tests/EventListener/LoginThrottlingListenerTest.php
@@ -73,6 +73,21 @@ public function testPreventsLoginWhenOverLocalThreshold()
         $this->listener->checkPassport($this->createCheckPassportEvent($passport));
     }
 
+    public function testPreventsLoginWithMultipleCase()
+    {
+        $request = $this->createRequest();
+        $passports = [$this->createPassport('wouter'), $this->createPassport('Wouter'), $this->createPassport('wOuter')];
+
+        $this->requestStack->push($request);
+
+        for ($i = 0; $i < 3; ++$i) {
+            $this->listener->checkPassport($this->createCheckPassportEvent($passports[$i % 3]));
+        }
+
+        $this->expectException(TooManyLoginAttemptsAuthenticationException::class);
+        $this->listener->checkPassport($this->createCheckPassportEvent($passports[0]));
+    }
+
     public function testPreventsLoginWhenOverGlobalThreshold()
     {
         $request = $this->createRequest();