Page MenuHomePhabricator

Add a rate limit to generating new account recovery links for a given account

Authored by epriestley on Jul 19 2019, 4:42 PM.



Depends on D20665. Ref T13343. We support CAPTCHAs on the "Forgot password?" flow, but not everyone configures them (or necessarily should, since ReCAPTCHA is a huge external dependency run by Google that requires you allow Google to execute JS on your domain) and the rate at which any reasonable user needs to take this action is very low.

Put a limit on the rate at which account recovery links may be generated for a particular account, so the worst case is a trickle of annoyance rather than a flood of nonsense.

Test Plan

Screen Shot 2019-07-19 at 9.39.15 AM.png (729×1 px, 139 KB)

Diff Detail

rP Phabricator
Lint Not Applicable
Tests Not Applicable