fluxerapp/fluxer
1
0
Fork 0
mirror of https://github.com/fluxerapp/fluxer.git synced 2026-09-02 21:04:06 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth): harden login rate keys and totp reuse (#2347)

Browse Source
This commit is contained in:
Hampus
2026-09-02 17:23:47 +02:00
committed by GitHub
parent 1d84689b45
commit 4fb14e85e8
2 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fluxer_api/src/api/auth/AuthLogin.ts
+12 -2
View File
@@ -38,6 +38,9 @@ import * as AuthPassword from './AuthPassword';
import * as AuthSession from './AuthSession';
import * as AuthUtility from './AuthUtility';
const DUMMY_ARGON2_HASH =
'$argon2id$v=19$m=65536,t=3,p=4$fT6tGpAyxFiz+n1RbkRqWQ$v05UT17QGeqhsgRjcVjIWcGw6gUDYeCcAA8FiZ63MtA';
interface LoginParams {
data: LoginRequest;
request: Request;
@@ -194,7 +197,7 @@ export async function login(
const {inviteService, kvDeletionQueue} = deps;
const skipRateLimits = config.dev.testModeEnabled || config.dev.disableRateLimits;
const emailRateLimit = await rateLimit.checkLimit({
identifier: `login:email:${data.email}`,
identifier: `login:email:${data.email.toLowerCase()}`,
maxAttempts: 5,
windowMs: ms('15 minutes'),
});
@@ -221,9 +224,16 @@ export async function login(
]);
}
AuthUtility.assertNonBotUser(ctx, user);
if (!user.passwordHash) {
await AuthPassword.verifyPassword(ctx, {password: data.password, passwordHash: DUMMY_ARGON2_HASH});
throw InputValidationError.fromCodes([
{path: 'email', code: ValidationErrorCodes.INVALID_EMAIL_OR_PASSWORD},
{path: 'password', code: ValidationErrorCodes.INVALID_EMAIL_OR_PASSWORD},
]);
}
const isMatch = await AuthPassword.verifyPassword(ctx, {
password: data.password,
passwordHash: user.passwordHash!,
passwordHash: user.passwordHash,
});
if (!isMatch) {
throw InputValidationError.fromCodes([
fluxer_api/src/api/auth/AuthMfa.ts
+1 -1
View File
@@ -79,7 +79,7 @@ export async function verifyMfaCode(ctx: ApiContext, params: VerifyMfaCodeParams
return true;
}
const reuseKey = `mfa-totp:${userId}:${code}`;
const lockToken = await cache.acquireLock(reuseKey, seconds('30 seconds'));
const lockToken = await cache.acquireLock(reuseKey, seconds('90 seconds'));
if (lockToken) {
return true;
}