clawbot
08f57bc105
All checks were successful
check / check (push) Successful in 6s
## Summary Adds per-IP rate limiting to `POST /api/v1/login` to prevent brute-force password attacks. closes #35 ## What Changed ### New package: `internal/ratelimit/` A generic per-key token-bucket rate limiter built on `golang.org/x/time/rate`: - `New(ratePerSec, burst)` creates a limiter with automatic background cleanup of stale entries - `Allow(key)` checks if a request from the given key should be permitted - `Stop()` terminates the background sweep goroutine - Stale entries (unused for 15 minutes) are pruned every 10 minutes ### Login handler integration The login handler (`internal/handlers/auth.go`) now: 1. Extracts the client IP from `X-Forwarded-For`, `X-Real-IP`, or `RemoteAddr` 2. Checks the per-IP rate limiter before processing the login 3. Returns **429 Too Many Requests** with a `Retry-After: 1` header when the limit is exceeded ### Configuration Two new environment variables (via Viper): | Variable | Default | Description | |---|---|---| | `LOGIN_RATE_LIMIT` | `1` | Allowed login attempts per second per IP | | `LOGIN_RATE_BURST` | `5` | Maximum burst of login attempts per IP | ### Scope Per [sneak's instruction](#35), only the login endpoint is rate-limited. Session creation and registration use hashcash proof-of-work instead. ## Tests - 6 unit tests for the `ratelimit` package (constructor, burst, burst exceeded, key isolation, key tracking, stop) - 2 integration tests in `api_test.go`: - `TestLoginRateLimitExceeded`: exhausts burst with rapid requests, verifies 429 response and `Retry-After` header - `TestLoginRateLimitAllowsNormalUse`: verifies normal login still works ## README - Added "Login Rate Limiting" subsection under "Rate Limiting & Abuse Prevention" - Added `LOGIN_RATE_LIMIT` and `LOGIN_RATE_BURST` to the Configuration table Co-authored-by: clawbot <clawbot@noreply.git.eeqj.de> Reviewed-on: #78 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>
107 lines
1.9 KiB
Go
107 lines
1.9 KiB
Go
package ratelimit_test
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"git.eeqj.de/sneak/neoirc/internal/ratelimit"
|
|
)
|
|
|
|
func TestNewCreatesLimiter(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
limiter := ratelimit.New(1.0, 5)
|
|
defer limiter.Stop()
|
|
|
|
if limiter == nil {
|
|
t.Fatal("expected non-nil limiter")
|
|
}
|
|
}
|
|
|
|
func TestAllowWithinBurst(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
limiter := ratelimit.New(1.0, 3)
|
|
defer limiter.Stop()
|
|
|
|
for i := range 3 {
|
|
if !limiter.Allow("192.168.1.1") {
|
|
t.Fatalf(
|
|
"request %d should be allowed within burst",
|
|
i+1,
|
|
)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestAllowExceedsBurst(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
// Rate of 0 means no token replenishment, only burst.
|
|
limiter := ratelimit.New(0, 3)
|
|
defer limiter.Stop()
|
|
|
|
for range 3 {
|
|
limiter.Allow("10.0.0.1")
|
|
}
|
|
|
|
if limiter.Allow("10.0.0.1") {
|
|
t.Fatal("fourth request should be denied after burst exhausted")
|
|
}
|
|
}
|
|
|
|
func TestAllowSeparateKeys(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
// Rate of 0, burst of 1 — only one request per key.
|
|
limiter := ratelimit.New(0, 1)
|
|
defer limiter.Stop()
|
|
|
|
if !limiter.Allow("10.0.0.1") {
|
|
t.Fatal("first request for key A should be allowed")
|
|
}
|
|
|
|
if !limiter.Allow("10.0.0.2") {
|
|
t.Fatal("first request for key B should be allowed")
|
|
}
|
|
|
|
if limiter.Allow("10.0.0.1") {
|
|
t.Fatal("second request for key A should be denied")
|
|
}
|
|
|
|
if limiter.Allow("10.0.0.2") {
|
|
t.Fatal("second request for key B should be denied")
|
|
}
|
|
}
|
|
|
|
func TestLenTracksKeys(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
limiter := ratelimit.New(1.0, 5)
|
|
defer limiter.Stop()
|
|
|
|
if limiter.Len() != 0 {
|
|
t.Fatalf("expected 0 entries, got %d", limiter.Len())
|
|
}
|
|
|
|
limiter.Allow("10.0.0.1")
|
|
limiter.Allow("10.0.0.2")
|
|
|
|
if limiter.Len() != 2 {
|
|
t.Fatalf("expected 2 entries, got %d", limiter.Len())
|
|
}
|
|
|
|
// Same key again should not increase count.
|
|
limiter.Allow("10.0.0.1")
|
|
|
|
if limiter.Len() != 2 {
|
|
t.Fatalf("expected 2 entries, got %d", limiter.Len())
|
|
}
|
|
}
|
|
|
|
func TestStopDoesNotPanic(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
limiter := ratelimit.New(1.0, 5)
|
|
limiter.Stop()
|
|
}
|