misty.cafe/mistykey
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

rate limit all password checks - fixes #540

Browse source 
all of these endpoints require the caller to already be logged in, so
it's not really much of a security problem, but it's still safer to
limit any endpoints that can be used to guess the current password
This commit is contained in:
dakkar 2024-07-12 11:15:58 +01:00
parent 7dfe9087b2
commit cced87da7f
8 changed files with 56 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
packages/backend/src/server/api/endpoints/i/regenerate-token.ts
View file

@ -11,10 +11,17 @@ import type { UsersRepository, UserProfilesRepository } from '@/models/_.js';
import generateUserToken from '@/misc/generate-native-user-token.js';
import { GlobalEventService } from '@/core/GlobalEventService.js';
import { DI } from '@/di-symbols.js';
import ms from 'ms';
export const meta = {
requireCredential: true,
limit: {
duration: ms('1hour'),
max: 10,
minInterval: ms('1sec'),
},
secure: true,
} as const;