fix(login): rate limiter shouldn't count successful logins - #3141
Merged
repo-ranger[bot] merged 14 commits intoApr 19, 2021
Merged
fix(login): rate limiter shouldn't count successful logins#3141repo-ranger[bot] merged 14 commits into
repo-ranger[bot] merged 14 commits into
Conversation
Copy link
Copy Markdown
Contributor
Sorry, something went wrong.
jsjoeio
commented
Apr 15, 2021
Comment thread
test/config.ts
Comment thread
test/config.ts
Outdated
Comment thread
test/e2e/login.test.ts
Comment thread
test/e2e/login.test.ts
Outdated
jsjoeio
marked this pull request as ready for review
April 15, 2021 23:52
oxy
suggested changes
Apr 16, 2021
oxy
left a comment
Copy link
Copy Markdown
There was a problem hiding this comment.
Ratelimiter needs adjustment - see individual review comments.
Sorry, something went wrong.
Comment thread
src/node/routes/login.ts
Comment thread
src/node/routes/login.ts
Comment thread
test/unit/routes/login.test.ts
Outdated
jsjoeio
force-pushed
the
jsjoeio/fix-login-rate-limiter
branch
from
0d5f223 to
fc85bf1
Compare
April 16, 2021 21:25
code-asher
reviewed
Apr 19, 2021
oxy
previously requested changes
Apr 19, 2021
oxy
left a comment
Copy link
Copy Markdown
There was a problem hiding this comment.
Just a few nits; looking in good shape otherwise!
Sorry, something went wrong.
Comment thread
test/unit/routes/login.test.ts
Outdated
Before, we weren't checking if a login was successful before counting it against the rate limiter. With this change, we only count unsuccessful logins against the rate limiter. We did this because this was a bug but also because it caused problems with our e2e tests hitting the rate limit.
This changes adds a new method called `.canTry` to the rate limiter to check if there are tokens remaining in the bucket. It also adds suggestions from @oxy to make sure the user can brute force past the rate limiter.
jsjoeio
force-pushed
the
jsjoeio/fix-login-rate-limiter
branch
from
fc85bf1 to
7928dc2
Compare
April 19, 2021 17:41
code-asher
approved these changes
Apr 19, 2021
Comment thread
test/e2e/login.test.ts
jsjoeio
force-pushed
the
jsjoeio/fix-login-rate-limiter
branch
from
d23c37c to
f80d5c3
Compare
April 19, 2021 20:14
jsjoeio
dismissed
oxy’s stale review
April 19, 2021 20:14
I've made the requested changed and Asher has approved.
oxy
approved these changes
Apr 19, 2021
oxy
left a comment
Copy link
Copy Markdown
There was a problem hiding this comment.
All looks good!
Sorry, something went wrong.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Reviewers
Assignees
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR fixes the login rate limiter to not count successful logins. This is important because it was causing issues with the e2e tests hitting the rate limit even though the logins were successful.
Changes
Fixes #2647