Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Implement rate limiter on reset password #5103

Closed
wants to merge 5 commits into from
Closed

Implement rate limiter on reset password #5103

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
ff8aa45
Implement rate limiter on reset password
Feb 8, 2024
2aa586e
Whoops, should be lower-case
Feb 8, 2024
be90e99
Merge branch 'main' into rate-limiter
jpelay Jun 27, 2024
3df1027
rearrange rate limiter
jpelay Jun 27, 2024
d3a97ee
fix e2e test
jpelay Jun 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion app.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2934,7 +2934,7 @@ def on_offline_mode():
# own file loading routines also hot-reload.
no_debug_mode_requested = os.getenv('NO_DEBUG_MODE')
utils.set_debug_mode(not no_debug_mode_requested)

utils.limiter.init_app(app)
if utils.is_offline_mode():
on_offline_mode()

Expand Down
1 change: 1 addition & 0 deletions requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,3 +36,4 @@ uflash>=2.0.0
pyinstaller==6.3.0
commonmark==0.9.1
check-jsonschema
flask-limiter==3.5.0
9 changes: 9 additions & 0 deletions utils.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,15 @@
from ruamel import yaml
import commonmark

from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

# Implement the rate limiter
limiter = Limiter(
get_remote_address,
storage_uri="memory://",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I managed to get the limiter working, but for us to make this really work on production we'd have to use a persistent storage solution, like memcached, redis or MongoDB. Now, all of these solutions come at a cost, since as far as I can tell, we'd need to pay a cloud provider for this (e.g; Memcached Cloud), with varying costs. @TiBiBa Did you have something in mind when opening this PR about this, do you know a way to fire a memcached server on Heroky without incurring on costs?

)

commonmark_parser = commonmark.Parser()
commonmark_renderer = commonmark.HtmlRenderer()

Expand Down
4 changes: 2 additions & 2 deletions website/auth_pages.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@

from flask import make_response, redirect, request, session
from flask_babel import gettext

from config import config
from safe_format import safe_format
from hedy_content import ALL_LANGUAGES, COUNTRIES
Expand All @@ -29,7 +28,7 @@
send_email_template,
validate_signup_data,
)

from utils import limiter
from .database import Database
from .website_module import WebsiteModule, route

Expand Down Expand Up @@ -371,6 +370,7 @@ def recover(self):
return make_response({"message": gettext("sent_password_recovery")}, 200)

@route("/reset", methods=["POST"])
@limiter.limit("1/day;1/hour;1/minute", exempt_when=lambda: is_testing_request(request))
def reset(self):
body = request.json
# Validations
Expand Down
Loading