Add rate limit to registration endpoint (#27060)

Currently the registration endpoint has no rate limit. Added a new ratelimit
variable to support the change, it's value is set to 60/7d.

VAN-302

openedx/core/djangoapps/user_authn/views/register.py

@@ -492,6 +492,7 @@ class RegistrationView(APIView):
                             content_type="application/json")
 
     @method_decorator(csrf_exempt)
+    @method_decorator(ratelimit(key=REAL_IP_KEY, rate=settings.REGISTRATION_RATELIMIT, method='POST'))
     def post(self, request):
         """Create the user's account.
 
@@ -510,6 +511,10 @@ class RegistrationView(APIView):
                 address already exists
             HttpResponse: 403 operation not allowed
         """
+        should_be_rate_limited = getattr(request, 'limited', False)
+        if should_be_rate_limited:
+            return JsonResponse({'error_code': 'forbidden-request'}, status=403)
+
         if is_require_third_party_auth_enabled() and not pipeline.running(request):
             # if request is not running a third-party auth pipeline
             return HttpResponseForbidden(

openedx/core/djangoapps/user_authn/views/tests/test_register.py

@@ -1632,6 +1632,38 @@ class RegistrationViewTestV1(ThirdPartyAuthTestMixin, UserAPITestCase):
             response = self.client.post(self.url, {"email": self.EMAIL, "username": self.USERNAME})
             assert response.status_code == 403
 
+    @override_settings(
+        CACHES={
+            'default': {
+                'BACKEND': 'django.core.cache.backends.locmem.LocMemCache',
+                'LOCATION': 'registration_proxy',
+            }
+        }
+    )
+    def test_rate_limiting_registration_view(self):
+        """
+        Confirm rate limits work as expected for registration
+        end point.
+        Note that drf's rate limiting makes use of the default cache
+        to enforce limits; that's why this test needs a "real"
+        default cache (as opposed to the usual-for-tests DummyCache)
+        """
+        payload = {
+            "email": 'email',
+            "name": self.NAME,
+            "username": self.USERNAME,
+            "password": self.PASSWORD,
+            "honor_code": "true",
+        }
+
+        for _ in range(int(settings.REGISTRATION_RATELIMIT.split('/')[0])):
+            response = self.client.post(self.url, payload)
+            assert response.status_code != 403
+
+        response = self.client.post(self.url, payload)
+        assert response.status_code == 403
+        cache.clear()
+
     def _assert_fields_match(self, actual_field, expected_field):
         """
         Assert that the actual field and the expected field values match.