#2783 limit number of failed login and reset password requests #2791

OskarKocjan · 2022-08-02T12:09:08Z

Changes:

added single window (IP) rate limiters to sign-in, sign-up, reset password request
added a new collection "failed_attempts" which holds states how many attempts were made for each of the previously mentioned endpoints from different IPs
added function which controls how many attempts were made to the sign-in and reset password request endpoints and blocks it when the number of failed requests exceeds set amount

codecov-commenter · 2022-08-03T10:39:03Z

Codecov Report

Merging #2791 (5a7ad5b) into main (a9b141e) will decrease coverage by 4.14%.
The diff coverage is 41.66%.

@@            Coverage Diff             @@
##             main    #2791      +/-   ##
==========================================
- Coverage   63.01%   58.87%   -4.15%     
==========================================
  Files          18      114      +96     
  Lines        1214     4532    +3318     
  Branches      187     1227    +1040     
==========================================
+ Hits          765     2668    +1903     
- Misses        449     1864    +1415

Impacted Files	Coverage Δ
.../components/AcknowledgmentsPage/helperFunctions.ts	`0.00% <0.00%> (ø)`
...cation/curator-service/api/src/controllers/auth.ts	`45.73% <14.28%> (-2.92%)`	⬇️
...ervice/api/src/util/single-window-rate-limiters.ts	`37.50% <37.50%> (ø)`
...n/curator-service/api/src/model/failed_attempts.ts	`53.84% <53.84%> (ø)`
...tion/curator-service/ui/src/components/Profile.tsx	`88.88% <100.00%> (ø)`
...src/components/landing-page/ChangePasswordForm.tsx	`80.00% <100.00%> (ø)`
...vice/ui/src/components/landing-page/SignUpForm.tsx	`74.62% <100.00%> (ø)`
...fication/curator-service/ui/src/redux/app/slice.ts	`75.86% <0.00%> (ø)`
...ce/ui/src/components/landing-page/PartnerLogos.tsx	`100.00% <0.00%> (ø)`
... and 91 more

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

maciej-zarzeczny

Everything works fine, the messages telling about going over the requests limit are showing fine on the frontend. I left some comments about code

verification/curator-service/api/src/controllers/auth.ts

verification/curator-service/api/src/model/failed_attempts.ts

verification/curator-service/api/src/controllers/auth.ts

verification/curator-service/api/src/model/failed_attempts.ts

…rength bar, test for login and registration

maciej-zarzeczny

Great work! 💯

verification/curator-service/api/src/model/failed_attempts.ts

verification/curator-service/ui/src/components/Profile.tsx

verification/curator-service/ui/src/components/landing-page/ChangePasswordForm.tsx

verification/curator-service/ui/src/components/landing-page/SignUpForm.tsx

abhidg

Looks good, not sure about some of the enums -- and the time limit windows vary

abhidg · 2022-08-12T09:53:07Z

verification/curator-service/api/src/controllers/auth.ts

+
+                    updateFailedAttempts(
+                        user._id,
+                        AttemptName.ResetPassword,


should be ForgotPassword

abhidg · 2022-08-12T09:55:00Z

verification/curator-service/api/src/controllers/auth.ts

                    // Check if token exists
                    const passwordResetToken = await tokens().findOne({
                        userId,
                    });
                    if (!passwordResetToken) {
+                        updateFailedAttempts(
+                            userId,
+                            AttemptName.ForgotPassword,


ResetPassword? not clear what's the difference

Thank you for your input! Of course, I made a mistake and assigned the wrong AttemptNames in sections of code that you highlighted but to answer your question I named them (AttemptName) accordingly:

Login - counter for login

ResetPassword - counter for resetting a password in a user's profile (already logged in)

ForgotPassword - counter for requesting a reset password link that is located on the landing page of the curator portal

ResetPasswordWithToken - counter for resetting the password through a form to which the user has access by an email link

abhidg · 2022-08-12T09:57:02Z

verification/curator-service/api/src/model/failed_attempts.ts

+const numberTimeLimiters = {
+    loginAttempt: {
+        maxNumberOfFailedLogins: 8,
+        timeWindowForFailedLogins: 60, //min


Better to put the unit in the property name like timeWindowForFailedLoginsMinutes

abhidg · 2022-08-12T10:02:58Z

verification/curator-service/api/src/util/single-window-rate-limiters.ts

+import rateLimit from 'express-rate-limit';
+
+export const loginLimiter = rateLimit({
+    windowMs: 20 * 60 * 1000, // 20 minutes


Should this be 60 minutes? It's different from numberTimeLimiters

abhidg · 2022-08-12T10:03:34Z

verification/curator-service/api/src/util/single-window-rate-limiters.ts

+});
+
+export const resetPasswordLimiter = rateLimit({
+    windowMs: 30 * 60 * 1000, // 30 minutes


same here, different from numberTimeLimiters

Oskar Kocjan added 2 commits August 2, 2022 10:23

login limiter done single window and brute forcing one user

f8c2ec0

added rate limiters to registration and reset password request

0752019

OskarKocjan requested a review from maciej-zarzeczny August 2, 2022 12:09

OskarKocjan self-assigned this Aug 2, 2022

OskarKocjan changed the title ~~2783 limit number of failed login and reset password requests~~ #2783 limit number of failed login and reset password requests Aug 2, 2022

password strength bar

deedd9a

maciej-zarzeczny reviewed Aug 3, 2022

View reviewed changes

Oskar Kocjan added 2 commits August 8, 2022 07:09

added request limiters to 3 methods of changing password, password st…

59438c5

…rength bar, test for login and registration

changes after review, added limiters to 3 types of reseting password

e752ce3

maciej-zarzeczny approved these changes Aug 9, 2022

View reviewed changes

Oskar Kocjan added 2 commits August 10, 2022 14:16

CR fixes

2f4a4a8

test fix

7ad3b47

OskarKocjan requested a review from maciej-zarzeczny August 10, 2022 12:59

correcting spelling

5a7ad5b

maciej-zarzeczny approved these changes Aug 12, 2022

View reviewed changes

maciej-zarzeczny requested a review from abhidg August 12, 2022 07:14

abhidg reviewed Aug 12, 2022

View reviewed changes

CR changes

8519e57

OskarKocjan requested a review from abhidg August 15, 2022 12:31

abhidg marked this pull request as ready for review August 15, 2022 14:45

abhidg approved these changes Aug 16, 2022

View reviewed changes

abhidg merged commit aa0adec into main Aug 16, 2022

abhidg deleted the 2783-limit-number-of-failed-login-and-reset-password-requests branch August 16, 2022 09:21

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

#2783 limit number of failed login and reset password requests #2791

#2783 limit number of failed login and reset password requests #2791

OskarKocjan commented Aug 2, 2022

codecov-commenter commented Aug 3, 2022 •

edited

Loading

maciej-zarzeczny left a comment

maciej-zarzeczny left a comment

abhidg left a comment

abhidg Aug 12, 2022

abhidg Aug 12, 2022

OskarKocjan Aug 12, 2022

abhidg Aug 12, 2022

abhidg Aug 12, 2022

abhidg Aug 12, 2022

#2783 limit number of failed login and reset password requests #2791

#2783 limit number of failed login and reset password requests #2791

Conversation

OskarKocjan commented Aug 2, 2022

codecov-commenter commented Aug 3, 2022 • edited Loading

Codecov Report

maciej-zarzeczny left a comment

Choose a reason for hiding this comment

maciej-zarzeczny left a comment

Choose a reason for hiding this comment

abhidg left a comment

Choose a reason for hiding this comment

abhidg Aug 12, 2022

Choose a reason for hiding this comment

abhidg Aug 12, 2022

Choose a reason for hiding this comment

OskarKocjan Aug 12, 2022

Choose a reason for hiding this comment

abhidg Aug 12, 2022

Choose a reason for hiding this comment

abhidg Aug 12, 2022

Choose a reason for hiding this comment

abhidg Aug 12, 2022

Choose a reason for hiding this comment

codecov-commenter commented Aug 3, 2022 •

edited

Loading