Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Implement rate limiter on reset password #5103

Draft
wants to merge 5 commits into
base: main
Choose a base branch
from
Draft

Implement rate limiter on reset password #5103

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
ff8aa45
Implement rate limiter on reset password
Feb 8, 2024
2aa586e
Whoops, should be lower-case
Feb 8, 2024
be90e99
Merge branch 'main' into rate-limiter
jpelay Jun 27, 2024
3df1027
rearrange rate limiter
jpelay Jun 27, 2024
d3a97ee
fix e2e test
jpelay Jun 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions app.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,9 @@
from flask_compress import Compress
from urllib.parse import quote_plus

from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

import hedy
import hedy_content
import hedy_translation
Expand Down Expand Up @@ -70,6 +73,14 @@
app.url_map.strict_slashes = False # Ignore trailing slashes in URLs
app.json = JinjaCompatibleJsonProvider(app)

# Implement the rate limiter
limiter = Limiter(
get_remote_address,
app=app,
storage_uri="memory://",
)


# Most files should be loaded through the CDN which has its own caching period and invalidation.
# Use 5 minutes as a reasonable default for all files we load elsewise.
app.config['SEND_FILE_MAX_AGE_DEFAULT'] = datetime.timedelta(minutes=5)
Expand Down
3 changes: 2 additions & 1 deletion requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,10 +28,11 @@ turtlethread>=0.0.6
pygame==2.1.2
pre-commit==2.20.0
babel==2.14.0
jinja-partials==0.1.1
jinja-partials==0.1.1clea
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suspect this is a typo @TiBiBa? Did you mean just to leave it at 0.1.1 or is there another version needed?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is a typo, will look into this. We should also decide on a nice test case, but that might be easy to fix on Alpha.

hypothesis>=6.75.3
tqdm==4.65.0
pytest-xdist==3.3.1
email-validator==2.1.0.post1
doit==0.36.0
doit_watch>=0.1.0
flask-limiter==3.5.0
2 changes: 2 additions & 0 deletions website/auth_pages.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
from flask import jsonify, make_response, redirect, request, session
from flask_babel import gettext

from app import limiter
from config import config
from safe_format import safe_format
from hedy_content import ALL_LANGUAGES, COUNTRIES
Expand Down Expand Up @@ -367,6 +368,7 @@ def recover(self):
return jsonify({"message": gettext("sent_password_recovery")}), 200

@ route("/reset", methods=["POST"])
@limiter.limit("100/day;10/hour;1/minute")
def reset(self):
body = request.json
# Validations
Expand Down
Loading