456d9d9e70
* [Security] Add per-address rate limiting for auth endpoints Introduce a thread-safe RateLimiter that tracks attempts per key (IP address) within a sliding time window, and wire it into the authentication endpoints: - Login: failed login attempts from an address are counted; once the configured maximum is exceeded within the window, further logins from that address are rejected with RespTooManyRequests. A successful login clears the failed attempts for that address. - Registration: implement the previously stubbed tooManyRegistrationAttempts, limiting how many accounts can be created per address per window. - Forgot-password: throttle both the email-request and the email-challenge paths per address. New [security] settings with defaults: max_login_attempts_per_ip=5 / login_attempt_window_seconds=900 max_registrations_per_ip=2 / registration_window_seconds=3600 max_forgot_password_requests_per_ip=3 / forgot_password_window_seconds=3600 Adds unit tests for the RateLimiter (window limit, over-limit blocking, clearing, per-key independence). Took 3 minutes * [Server] Fix rate limiter: disable semantics, draining window, bounded keys, pre-work login gate - recordAttempt()/isBlocked() return false when maxAttempts <= 0 or windowSeconds <= 0, so the documented 'set to 0 to disable' actually disables instead of blocking every address permanently - Keys at their limit are rejected without recording, so repeated attempts at the attacker's pace cannot keep sliding the window and holding the lockout open; a block now clears once the recorded attempts age out of windowSeconds - Attempts map is bounded: an opportunistic prune (every 60s) erases keys whose attempts have fully aged out - Login is throttled before the work: isLoginRateLimited() (a new virtual on Server, backed by isBlocked()) gates loginUser(), so a locked-out address no longer burns a database round trip and password verification per attempt - recordAttemptAt()/isBlockedAt() time seams make the sliding-window behaviour deterministically testable; tests rewritten for the real semantics (no reliance on the maxAttempts=0 bug, no sleeps) * [Server] Inform client of login/registration rate limit timeout - Add retryAfterSeconds/retryAfterSecondsAt to RateLimiter to compute seconds until oldest attempt exits the sliding window - Expose loginRateLimitRemainingSeconds via Server/Servatrice - Include denied_end_time (absolute epoch) in RespTooManyRequests for login pre-auth and when transitioning to lockout after failed attempt - Include denied_end_time in registration rate limit response - Client: show retry time for login RespTooManyRequests - Client: simplify registration RespTooManyRequests message to show retry time when provided - Add test for retryAfterSecondsAt * [Client] Restore registration guidance and drop duplicated rate limit reason The registration RespTooManyRequests case now only shows the retry-after copy when the server actually sent a denied_end_time; the per-email account cap path (no end time) falls back to the previous guidance about already having an account and contacting the server operator. Drop the canned denied_reason_str from the new login rate limit branches so the client no longer prints the same sentence twice. * [Server] Exempt trusted_sources from auth rate limits Addresses in security/trusted_sources bypass per-address limits, matching the existing max_users_per_address bypass in initSession. Without this, Webatrice behind local nginx (all clients as 127.0.0.1) would lock out every web user after 5 mistyped passwords, and cap the whole server at 2 registrations / 3 forgot-password requests per window. Adds Servatrice::isRateLimitExempt helper; recordFailedLogin, isLoginRateLimited, recordRegistrationAttempt and recordForgotPasswordAttempt all check it. # Conflicts: # servatrice/src/servatrice.cpp * [Server] Key login rate limit by (address, username) A successful login cleared the whole per-IP failure history, so 4 bad guesses plus 1 self-login (or guest UnknownUser login) from the same address bypassed the limiter. Failures are now bucketed per (address, lowercase username) and a success clears only its own pair. --------- Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
Cockatrice | Download | Related | Community | Contribute | Build | Run
To get started with Cockatrice ⇢ view our webpage
To get support, or suggest changes to the app ⇢ file an issue (How?) To help with development ⇢ learn how to contribute
Cockatrice
Cockatrice is an open-source, multiplatform application for playing tabletop card games over a network. The program's server design prevents users from manipulating the game for unfair advantage. The client also provides a single-player mode, which allows users to brew while offline.
This project uses C++ and the Qt libraries.
Download 
Downloads are available for stable releases and the current beta version in development.
There is no strict release schedule for either of them.
Latest stable release:
Latest beta version:
While incorporating the latest fixes and features, beta builds may not be stable or contain new bugs! Please report any findings and open new issues when testing them!
Related Repositories
- Magic-Token: File with MtG token data for use in Cockatrice
- Magic-Spoiler: Code to generate MtG spoiler data from MTGJSON for use in Cockatrice
- cockatrice.github.io: Code of the official Cockatrice webpage
- io.github.Cockatrice.cockatrice: Configuration of our Linux
flatpakpackage hosted at Flathub - Webatrice: Web client for Cockatrice servers (TypeScript / React)
Community Resources 
Join our Discord community to connect with other project contributors (#dev channel) or fellow users of the app. Come here to talk about the application, features, or just to hang out.
Important
For support regarding specific servers, please contact that server's admin/mods and use their dedicated communication channels rather than contacting the team building the software.
Contribute
Code | Documentation | Translation
Repository Activity
Code
To contribute code to the project, please review our guidelines first.
We maintain two tags for contributors to easier find issues to potentially work on:
Issues tagged in this way provide a simple way to get started. They don't require much experience to be worked on.
This tag is used for issues that we are looking for somebody to pick up. Often this is for feature suggestions we support, but don't have the time to work on ourselves.
For both tags, we're willing to provide help to contributors in showing them where and how they can make changes, as well as code reviews for submitted changes.
We'll happily advice on how best to implement a feature, or we can show you where the codebase is doing something similar before you get too far along - put a note on an issue you want to discuss more on!
You can also have a look at our Todo List in our Code Documentation or search the repo for \todo comments.
Documentation 
There are various places where useful information for different needs are maintained:
- Official Code Documentation
- Official Wiki
Community supported - Official Webpage
- Official README
This file - Official CONTRIBUTING
Cockatrice tries to use the Google Developer Documentation Style Guide to ensure consistent documentation. We encourage you to improve the documentation by suggesting edits based on this guide.
Translation 
Cockatrice uses Transifex to manage translations. You can help us bring Cockatrice and Oracle to your language and just adjust single wordings right from within your browser by visiting our Transifex project page. The Webatrice web client manages its own translations in its repo.
Check out our Translator FAQ for more information about getting involved, and join a group of hundreds of others!
Build 
Dependencies: (for minimum versions search our CMake file)
Oracle can optionally use some packages to load compressed card files:
Basic compilation steps:
mkdir build
cd build
cmake ..
make
You can then
- Create a Cockatrice installation inside the
releasefolder:make install - Or make an installation package specific to your system:
make package
Note
Detailed compiling instructions can be found in the Cockatrice wiki at Compiling Cockatrice
The following flags (with their non-default values) can be passed to cmake:
| Flag | Description |
|---|---|
-DWITH_SERVER=1 |
Build Servatrice server |
-DWITH_CLIENT=0 |
Don't build Cockatrice client |
-DWITH_ORACLE=0 |
Don't build Oracle card database tool |
-DCMAKE_BUILD_TYPE=Debug |
Compile in debug mode Enables extra logging output, debug symbols, and much more verbose compiler warnings |
-DWARNING_AS_ERROR=0 |
Don't treat compilation warnings as errors in debug mode |
-DUPDATE_TRANSLATIONS=1 |
Configure make to update the translation .ts files for new strings in the source codeNote: make clean will remove the .ts files |
-DTEST=1 |
Enable regression tests Note: make test to run tests, googletest will be downloaded if not available |
Tip
Build code documentation (Doxygen) according to our configuration into
/docs:doxygen Doxyfile
Run
Cockatrice is the game client
Oracle fetches card data
Servatrice is the server
Docker
You can build an image & deploy a Servatrice (Cockatrice server) container using Docker and our Dockerfile yourself.
For more details, look into our wiki section on Setting up Servatrice.
You'll also find more hints on our pre-build image there, or the docker-compose file which will configure and run both a MySQL server and Servatrice.
License 
Cockatrice is free software, licensed under the GPLv2.