Page MenuHomePhabricator

Rate limit attempts to add payment methods in Phortune
ClosedPublic

Authored by epriestley on Feb 13 2019, 1:18 PM.
Tags
None
Referenced Files
F13274397: D20158.diff
Fri, May 31, 3:39 AM
F13260443: D20158.diff
Sun, May 26, 11:55 PM
F13242778: D20158.diff
Thu, May 23, 3:05 AM
F13221129: D20158.diff
Sun, May 19, 2:17 AM
F13203518: D20158.diff
Tue, May 14, 11:50 PM
F13185947: D20158.diff
Sat, May 11, 3:19 AM
Unknown Object (File)
May 7 2024, 12:08 PM
Unknown Object (File)
May 7 2024, 5:58 AM
Subscribers
None

Details

Summary

Ref T13249. See D20132. Although we're probably a poor way to validate a big list of stolen cards in practice in production today (it's very hard to quickly generate a large number of small charges), putting rate limiting on "Add Payment Method" is generally reasonable, can't really hurt anything (no legitimate user will ever hit this limit), and might frustrate attackers in the future if it becomes easier to generate ad-hoc charges (for example, if we run a deal on support pacts and reduce their cost from $1,000 to $1).

Test Plan

Reduced limit to 4 / hour, tried to add a card several times, got rate limited.

Diff Detail

Repository
rP Phabricator
Lint
Lint Not Applicable
Unit
Tests Not Applicable