Andal.LND/edx-platform
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "Increase requests limit for logistration rate limit."

Browse Source 
This reverts commit a1c018823d.
This commit is contained in:
Feanil Patel
2020-05-21 11:40:47 -04:00
parent f8963fe11e
commit 72ea1b7d4f
3 changed files with 4 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
common/djangoapps/util/request_rate_limiter.py
View File

@@ -101,11 +101,3 @@ class PasswordResetEmailRateLimiter(RequestRateLimiter):
""" """
for key in self.keys_to_check(request): for key in self.keys_to_check(request):
self.cache_incr(key) self.cache_incr(key)
class LoginAndRegisterRateLimiter(RequestRateLimiter):
"""
Rate limiting backend for login and register endpoint which
allows 50 requests per IP for every 5 minutes.
"""
requests = 50

4
openedx/core/djangoapps/user_authn/views/login_form.py
View File

@@ -35,7 +35,7 @@ from student.helpers import get_next_url_for_login_page
from third_party_auth import pipeline from third_party_auth import pipeline
from third_party_auth.decorators import xframe_allow_whitelisted from third_party_auth.decorators import xframe_allow_whitelisted
from util.password_policy_validators import DEFAULT_MAX_PASSWORD_LENGTH from util.password_policy_validators import DEFAULT_MAX_PASSWORD_LENGTH
from util.request_rate_limiter import LoginAndRegisterRateLimiter from util.request_rate_limiter import BadRequestRateLimiter
log = logging.getLogger(__name__) log = logging.getLogger(__name__)
@@ -138,7 +138,7 @@ def login_and_registration_form(request, initial_mode="login"):
""" """
limiter = LoginAndRegisterRateLimiter() limiter = BadRequestRateLimiter()
if limiter.is_rate_limit_exceeded(request): if limiter.is_rate_limit_exceeded(request):
log.warning("Rate limit exceeded in login and registration with initial mode [%s]", initial_mode) log.warning("Rate limit exceeded in login and registration with initial mode [%s]", initial_mode)
return HttpResponseForbidden("Rate limit exceeded") return HttpResponseForbidden("Rate limit exceeded")

4
openedx/core/djangoapps/user_authn/views/tests/test_logistration.py
View File

@@ -75,10 +75,10 @@ class LoginAndRegistrationTest(ThirdPartyAuthTestMixin, UrlResetMixin, ModuleSto
def test_login_and_registration_form_ratelimited(self): def test_login_and_registration_form_ratelimited(self):
""" """
Test that login enpoint allow only 50 requests for every 5 minutes. Test that login enpoint allow only 30 requests for every 5 minutes.
""" """
login_url = reverse('signin_user') login_url = reverse('signin_user')
for i in range(50): for i in range(30):
response = self.client.get(login_url) response = self.client.get(login_url)
self.assertEqual(response.status_code, 200) self.assertEqual(response.status_code, 200)