2要素認証におけるブルートフォース対策の実装

app/config/eccube/packages/prod/eccube_rate_limiter.yaml

@@ -17,37 +17,37 @@ eccube:
         mypage_change:
             route: mypage_change
             method: [ 'POST' ]
-            type: customer
+            type: user
             limit: 10
             interval: '30 minutes'
         mypage_delivery_new:
             route: mypage_delivery_new
             method: [ 'POST' ]
-            type: customer
+            type: user
             limit: 10
             interval: '30 minutes'
         mypage_delivery_edit:
             route: mypage_delivery_edit
             method: [ 'POST' ]
-            type: customer
+            type: user
             limit: 10
             interval: '30 minutes'
         mypage_delivery_delete:
             route: mypage_delivery_delete
             method: [ 'DELETE' ]
-            type: customer
+            type: user
             limit: 10
             interval: '30 minutes'
         shopping_shipping_multiple_edit_customer:
             route: shopping_shipping_multiple_edit
             method: [ 'POST' ]
-            type: customer
+            type: user
             limit: 10
             interval: '30 minutes'
         shopping_shipping_edit_customer:
             route: shopping_shipping_edit
             method: [ 'POST' ]
-            type: customer
+            type: user
             limit: 10
             interval: '30 minutes'
         contact:
@@ -74,3 +74,9 @@ eccube:
             route: ~
             limit: 10
             interval: '30 minutes'
+        admin_two_factor_auth:
+            route: admin_two_factor_auth
+            method: [ 'POST' ]
+            type: user
+            limit: 5
+            interval: '30 minutes'

src/Eccube/DependencyInjection/Configuration.php

@@ -61,7 +61,7 @@ public function addRateLimiterSection(ArrayNodeDefinition $rootNode): void
                                             ->ifArray()
                                             ->then(fn (array $v) => \array_map(fn ($method) => \strtolower($method), $v))
                                         ->end()
-                                    ->enumPrototype()->values(['ip', 'customer'])->end()
+                                    ->enumPrototype()->values(['ip', 'customer', 'user'])->end()
                                         ->defaultValue([])
                                     ->end()
                                     ->arrayNode('method')

src/Eccube/EventListener/RateLimiterListener.php

@@ -15,6 +15,7 @@
 
 use Eccube\Common\EccubeConfig;
 use Eccube\Entity\Customer;
+use Eccube\Entity\Member;
 use Eccube\Request\Context;
 use Psr\Container\ContainerInterface;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
@@ -77,14 +78,20 @@ public function onController(ControllerEvent $event)
 
             /** @var RateLimiterFactory $factory */
             $factory = $this->locator->get($limiterId);
-            if (in_array('customer', $config['type'])) {
+            if (in_array('customer', $config['type']) || in_array('user', $config['type'])) {
                 $User = $this->requestContext->getCurrentUser();
                 if ($User instanceof Customer) {
                     $limiter = $factory->create($User->getId());
                     if (!$limiter->consume()->isAccepted()) {
                         throw new TooManyRequestsHttpException();
                     }
                 }
+                if ($User instanceof Member) {
+                    $limiter = $factory->create($User->getId());
+                    if (!$limiter->consume()->isAccepted()) {
+                        throw new TooManyRequestsHttpException();
+                    }
+                }
             }
             if (in_array('ip', $config['type'])) {
                 $limiter = $factory->create($request->getClientIp());