mirror of
https://github.com/Cockatrice/Cockatrice.git
synced 2026-08-06 02:33:48 -05:00
b2f63255f0
Introduce a thread-safe RateLimiter that tracks attempts per key (IP address) within a sliding time window, and wire it into the authentication endpoints: - Login: failed login attempts from an address are counted; once the configured maximum is exceeded within the window, further logins from that address are rejected with RespTooManyRequests. A successful login clears the failed attempts for that address. - Registration: implement the previously stubbed tooManyRegistrationAttempts, limiting how many accounts can be created per address per window. - Forgot-password: throttle both the email-request and the email-challenge paths per address. New [security] settings with defaults: max_login_attempts_per_ip=5 / login_attempt_window_seconds=900 max_registrations_per_ip=2 / registration_window_seconds=3600 max_forgot_password_requests_per_ip=3 / forgot_password_window_seconds=3600 Adds unit tests for the RateLimiter (window limit, over-limit blocking, clearing, per-key independence). Took 3 minutes |
||
|---|---|---|
| .. | ||
| card_zone_algorithms | ||
| carddatabase | ||
| loading_from_clipboard | ||
| movecard_tests | ||
| oracle | ||
| settings | ||
| clamped_arithmetic_test.cpp | ||
| CMakeLists.txt | ||
| deck_hash_performance_test.cpp | ||
| dummy_test.cpp | ||
| expression_test.cpp | ||
| password_hash_test.cpp | ||
| rate_limiter_test.cpp | ||
| server_card_counter_test.cpp | ||
| server_counter_test.cpp | ||
| test_age_formatting.cpp | ||