e30605d419
* fix: add rate limiting to email/password sign-in and sign-up endpoints All four password authentication views (app sign-in, app sign-up, space sign-in, space sign-up) extended django.views.View, so DRF's global AnonRateThrottle never ran and the endpoints accepted unlimited credential guesses with no friction (brute-force / credential stuffing, GHSA-349j). Add authentication_throttle_allows(request) at the top of each post() method — before any DB access — using the same AuthenticationThrottle already guarding the magic-code views. On rejection the view redirects with RATE_LIMIT_EXCEEDED, consistent with all other throttled auth endpoints. Default limit remains 10/minute, overridable via AUTHENTICATION_RATE_LIMIT. Co-authored-by: Plane AI <noreply@plane.so> * refactor: consolidate auth throttle into a decorator + add tests - Extract the repeated throttle-and-redirect block from the six redirect-flow auth views (email + magic, app + space) into a single throttle_auth_redirect decorator in rate_limit.py. Behaviour is unchanged: the throttle still runs before any DB access; brute-force traffic is rejected without a DB hit. - Add regression tests for the password sign-in/sign-up throttle on both app and space endpoints, mirroring the existing magic-code throttle tests. - Reset the shared AuthenticationThrottle bucket before every test in test_authentication.py. All auth endpoints share one per-IP throttle scope, so the newly-throttled password requests exhausted the budget mid-file and caused unrelated tests to trip RATE_LIMIT_EXCEEDED. --------- Co-authored-by: Plane AI <noreply@plane.so> Co-authored-by: sriramveeraghanta <veeraghanta.sriram@gmail.com>
109 lines
4.1 KiB
Python
109 lines
4.1 KiB
Python
# Copyright (c) 2023-present Plane Software, Inc. and contributors
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
# See the LICENSE file for details.
|
|
|
|
# Python imports
|
|
import os
|
|
from functools import wraps
|
|
|
|
# Third party imports
|
|
from rest_framework.throttling import AnonRateThrottle, UserRateThrottle
|
|
from rest_framework import status
|
|
from rest_framework.response import Response
|
|
|
|
# Django imports
|
|
from django.http import HttpResponseRedirect
|
|
|
|
# Module imports
|
|
from plane.authentication.adapter.error import (
|
|
AuthenticationException,
|
|
AUTHENTICATION_ERROR_CODES,
|
|
)
|
|
from plane.authentication.utils.host import base_host
|
|
from plane.utils.path_validator import get_safe_redirect_url
|
|
|
|
|
|
class AuthenticationThrottle(AnonRateThrottle):
|
|
# Rate is configurable per-deployment via the AUTHENTICATION_RATE_LIMIT
|
|
# env var (DRF format: "<num>/<period>" where period is second/minute/hour/day).
|
|
rate = os.environ.get("AUTHENTICATION_RATE_LIMIT", "10/minute")
|
|
scope = "authentication"
|
|
|
|
def throttle_failure_view(self, request, *args, **kwargs):
|
|
try:
|
|
raise AuthenticationException(
|
|
error_code=AUTHENTICATION_ERROR_CODES["RATE_LIMIT_EXCEEDED"],
|
|
error_message="RATE_LIMIT_EXCEEDED",
|
|
)
|
|
except AuthenticationException as e:
|
|
return Response(e.get_error_dict(), status=status.HTTP_429_TOO_MANY_REQUESTS)
|
|
|
|
|
|
def authentication_throttle_allows(request):
|
|
"""
|
|
Apply AuthenticationThrottle to a plain django.views.View request.
|
|
|
|
DRF's throttle_classes only run inside APIView.initial(); the magic
|
|
sign-in / sign-up endpoints extend django.views.View to return
|
|
HttpResponseRedirect from a form POST flow, so they need a manual
|
|
throttle check. Returns True if the request is allowed through,
|
|
False if it should be rejected with a RATE_LIMIT_EXCEEDED error.
|
|
"""
|
|
throttle = AuthenticationThrottle()
|
|
# SimpleRateThrottle.allow_request only reads request.META and
|
|
# request.user, both available on a plain Django HttpRequest.
|
|
return throttle.allow_request(request, None)
|
|
|
|
|
|
def throttle_auth_redirect(*, is_app=False, is_space=False):
|
|
"""
|
|
Decorator for redirect-flow ``django.views.View`` POST handlers.
|
|
|
|
Applies AuthenticationThrottle before the wrapped handler runs; when the
|
|
per-IP budget is exceeded it short-circuits with a RATE_LIMIT_EXCEEDED
|
|
redirect to the auth error page (the same behaviour every throttled auth
|
|
endpoint uses). The throttle runs before any DB access in the handler, so
|
|
brute-force traffic is rejected without touching the database.
|
|
|
|
Pass ``is_app=True`` for /app auth views and ``is_space=True`` for /spaces
|
|
auth views so the redirect targets the correct base host.
|
|
"""
|
|
|
|
def decorator(post_method):
|
|
@wraps(post_method)
|
|
def wrapper(self, request, *args, **kwargs):
|
|
if not authentication_throttle_allows(request):
|
|
exc = AuthenticationException(
|
|
error_code=AUTHENTICATION_ERROR_CODES["RATE_LIMIT_EXCEEDED"],
|
|
error_message="RATE_LIMIT_EXCEEDED",
|
|
)
|
|
url = get_safe_redirect_url(
|
|
base_url=base_host(request=request, is_app=is_app, is_space=is_space),
|
|
next_path=request.POST.get("next_path"),
|
|
params=exc.get_error_dict(),
|
|
)
|
|
return HttpResponseRedirect(url)
|
|
return post_method(self, request, *args, **kwargs)
|
|
|
|
return wrapper
|
|
|
|
return decorator
|
|
|
|
|
|
class EmailVerificationThrottle(UserRateThrottle):
|
|
"""
|
|
Throttle for email verification code generation.
|
|
Limits to 3 requests per hour per user to prevent abuse.
|
|
"""
|
|
|
|
rate = "3/hour"
|
|
scope = "email_verification"
|
|
|
|
def throttle_failure_view(self, request, *args, **kwargs):
|
|
try:
|
|
raise AuthenticationException(
|
|
error_code=AUTHENTICATION_ERROR_CODES["RATE_LIMIT_EXCEEDED"],
|
|
error_message="RATE_LIMIT_EXCEEDED",
|
|
)
|
|
except AuthenticationException as e:
|
|
return Response(e.get_error_dict(), status=status.HTTP_429_TOO_MANY_REQUESTS)
|