Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Login throttling #37266

Closed
seb-jean opened this issue Jun 13, 2020 · 8 comments · Fixed by #38204
Closed

Login throttling #37266

seb-jean opened this issue Jun 13, 2020 · 8 comments · Fixed by #38204
Labels
Feature Security

Comments

@seb-jean
Copy link
Contributor

Hi :)

It would be great to have an option for the connection to limit the number of failed login attempts over a period of time.

Thanks :)
@simonberger
Copy link
Contributor

This is part of #30914 but there seems to exist no specific issue yet.
It could be noted behind the entry of the rework tasks
/cc @curry684

@fabpot
Copy link
Member

fabpot commented Jun 15, 2020

Closing here as this is already part of #30914

@fabpot fabpot closed this as completed Jun 15, 2020
@curry684
Copy link
Contributor

there seems to exist no specific issue yet.

Simply means nobody is working on it publicly. #30914 is a tracker issue grouping a ton of marginally related tasks to get security up to date. Once somebody picks it up the PR will be the tracker.

@simonberger
Copy link
Contributor

Simply means nobody is working on it publicly. #30914 is a tracker issue grouping a ton of marginally related tasks to get security up to date. Once somebody picks it up the PR will be the tracker.

I added the note because I was surprised there was no issue for it yet.
I do not really agree to close this. The tracker issue #30914 can still change a lot and entries being removed.

@curry684
Copy link
Contributor

There is no added value in this issue now - it's just reiterating the task in the tracker issue. If it would have been a full proposal with a screen of specs it would've been a different case, now it's just a duplicate.

It should also be noted that #33558 added VerifyAuthenticatorCredentialsEvent and LoginFailed events which can be trivially used to implement login throttling. First class citizen support is just a wishlist item on top of that.

@wouterj
Copy link
Member

wouterj commented Jun 15, 2020

Yeah, I would recommend creating a listener on these events and storing a count in the session. We don't need to add this to the "legacy" security system.

I think Laravel's ThrottlesLogins implementation can function as example on how to do this.

@wouterj wouterj mentioned this issue Jun 28, 2020
Closed
@wouterj wouterj mentioned this issue Sep 15, 2020
Merged
fabpot added a commit that referenced this issue Sep 17, 2020
@fabpot
feature #38204 [Security] Added login throttling feature (wouterj)
237d91f 
This PR was squashed before being merged into the 5.2-dev branch.

Discussion
----------

[Security] Added login throttling feature

| Q             | A
| ------------- | ---
| Branch?       | master
| Bug fix?      | no
| New feature?  | yes
| Deprecations? | no
| Tickets       | Fix #37266
| License       | MIT
| Doc PR        | tbd

This "recreates" #37444 based on the RateLimiter component from #37546 <s>(commits are included in this branch atm)</s>.

Login throttling can be enabled on any user-based authenticator (thanks to the `UserBadge`) with this configuration:

```yaml
security:
    firewalls:
        default:
            # default limits to 5 login attempts per minute, the number can be configured via "max_attempts"
            login_throttling: ~

            # or you can define your own RateLimiter on framework.rate_limiter and configure it instead:
            login_throttling:
                limiter: login
```

Commits
-------

afdd805 [Security] Added login throttling feature
@fabpot
Copy link
Member

fabpot commented Sep 17, 2020

Implemented in 5.2.

@seb-jean
Copy link
Contributor Author

Thanks all!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Feature Security
Projects
None yet
Milestone
No milestone
6 participants
@fabpot @javiereguiluz @wouterj @curry684 @simonberger @seb-jean