Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[stable27] feat(security): Add a bruteforce protection backend base on memcache #39997

Merged
merged 8 commits into from
Aug 23, 2023
Merged

[stable27] feat(security): Add a bruteforce protection backend base on memcache #39997

merged 8 commits into from
Aug 23, 2023
+879 −197

Commits on Aug 23, 2023

  1. feat(security): Add a bruteforce protection backend base on memcache 

    Similar to the ratelimit backend

Signed-off-by: Joas Schilling <coding@schilljs.com>
    @nickvergessen
    nickvergessen committed Aug 23, 2023
    Configuration menu
    Copy the full SHA
    befa2f6 View commit details
    Browse the repository at this point in the history

  2. feat(security): Add a "testing mode" for bruteforce protection that d… 

    …oesn't sleep

Signed-off-by: Joas Schilling <coding@schilljs.com>
    @nickvergessen
    nickvergessen committed Aug 23, 2023
    Configuration menu
    Copy the full SHA
    97548e7 View commit details
    Browse the repository at this point in the history

  3. feat: Add a header which signals that the request was throttled 

    Signed-off-by: Joas Schilling <coding@schilljs.com>
    @nickvergessen
    nickvergessen committed Aug 23, 2023
    Configuration menu
    Copy the full SHA
    5c07891 View commit details
    Browse the repository at this point in the history

  4. feat: Expose if the own IP is allowed to bypass bruteforce protection 

    Signed-off-by: Joas Schilling <coding@schilljs.com>
    @nickvergessen
    nickvergessen committed Aug 23, 2023
    Configuration menu
    Copy the full SHA
    b55359b View commit details
    Browse the repository at this point in the history

  5. feat(OCC): Add a command to get the bruteforce state of an IP 

    Signed-off-by: Joas Schilling <coding@schilljs.com>
    @nickvergessen
    nickvergessen committed Aug 23, 2023
    Configuration menu
    Copy the full SHA
    b5dbb4d View commit details
    Browse the repository at this point in the history

  6. fix: Make bypass function public API 

    Signed-off-by: Joas Schilling <coding@schilljs.com>
    @nickvergessen
    nickvergessen committed Aug 23, 2023
    Configuration menu
    Copy the full SHA
    759fc11 View commit details
    Browse the repository at this point in the history

  7. feat(admin): Show an error when the admin is throttled 

    Signed-off-by: Joas Schilling <coding@schilljs.com>
    @nickvergessen
    nickvergessen committed Aug 23, 2023
    Configuration menu
    Copy the full SHA
    866a8a2 View commit details
    Browse the repository at this point in the history

  8. fix(middleware): Fix header injection for bruteforce middleware 

    Calling setHeaders(getHeaders()) breaks the CSP nonce for unknown reasons
So shifting back to old standard practise for now

Signed-off-by: Joas Schilling <coding@schilljs.com>
    @nickvergessen
    nickvergessen committed Aug 23, 2023
    Configuration menu
    Copy the full SHA
    26832ec View commit details
    Browse the repository at this point in the history