sendnrw/pocket-id
2
0
Fork 0
mirror of https://github.com/pocket-id/pocket-id.git synced 2026-10-14 05:39:05 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: rate limit updating the own account to slow down user enumeration

Browse Source
This commit is contained in:
Elias Schneider
2026-10-09 20:35:02 +02:00
parent ade55206b8
commit 226648c7b2
4 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/internal/middleware/rate_limit.go
+2
View File
@@ -19,6 +19,7 @@ import (
const (
RateLimitAPI = "api"
RateLimitSignup = "signup"
RateLimitUpdateOwnAccount = "update-own-account"
RateLimitWebauthnLogin = "webauthn-login"
RateLimitWebauthnReauthenticate = "webauthn-reauthenticate"
RateLimitOneTimeAccessToken = "one-time-access-token"
@@ -50,6 +51,7 @@ func RateLimitPolicies() []RateLimitPolicy {
return []RateLimitPolicy{
{Name: RateLimitAPI, Rate: 100, Per: time.Second, Burst: 300},
{Name: RateLimitSignup, Rate: 2, Per: time.Minute, Burst: 10},
{Name: RateLimitUpdateOwnAccount, Rate: 2, Per: time.Minute, Burst: 10},
{Name: RateLimitWebauthnLogin, Rate: 1, Per: 5 * time.Second, Burst: 10},
{Name: RateLimitWebauthnReauthenticate, Rate: 1, Per: 10 * time.Second, Burst: 5},
{Name: RateLimitOneTimeAccessToken, Rate: 1, Per: 10 * time.Second, Burst: 5},