Repository navigation
fix(login): rate limiter shouldn't count successful logins - #3141
Merged
Merged
Conversation
jsjoeio
commented
Apr 15, 2021
jsjoeio
marked this pull request as ready for review
April 15, 2021 23:52
oxy
suggested changes
Apr 16, 2021
oxy
left a comment
There was a problem hiding this comment.
Ratelimiter needs adjustment - see individual review comments.
jsjoeio
force-pushed
the
jsjoeio/fix-login-rate-limiter
branch
from
April 16, 2021 21:25
0d5f223 to
fc85bf1
Compare
code-asher
reviewed
Apr 19, 2021
oxy
previously requested changes
Apr 19, 2021
oxy
left a comment
There was a problem hiding this comment.
Just a few nits; looking in good shape otherwise!
Before, we weren't checking if a login was successful before counting it against the rate limiter. With this change, we only count unsuccessful logins against the rate limiter. We did this because this was a bug but also because it caused problems with our e2e tests hitting the rate limit.
This changes adds a new method called `.canTry` to the rate limiter to check if there are tokens remaining in the bucket. It also adds suggestions from @oxy to make sure the user can brute force past the rate limiter.
jsjoeio
force-pushed
the
jsjoeio/fix-login-rate-limiter
branch
from
April 19, 2021 17:41
fc85bf1 to
7928dc2
Compare
code-asher
approved these changes
Apr 19, 2021
jsjoeio
force-pushed
the
jsjoeio/fix-login-rate-limiter
branch
from
April 19, 2021 20:14
d23c37c to
f80d5c3
Compare
jsjoeio
dismissed
oxy’s stale review
April 19, 2021 20:14
I've made the requested changed and Asher has approved.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR fixes the login rate limiter to not count successful logins. This is important because it was causing issues with the e2e tests hitting the rate limit even though the logins were successful.
Changes
RateLimiterloginPage.test.tsintologin.test.tsRateLimiter.canTry()to check remaining tokensFixes #2647