Page MenuHomePhabricator

Rate limit multi-factor actions
ClosedPublic

Authored by epriestley on Apr 30 2014, 4:21 PM.
Tags
None
Referenced Files
F15417643: D8911.id21146.diff
Thu, Mar 20, 5:45 PM
F15417641: D8911.id21167.diff
Thu, Mar 20, 5:45 PM
F15388392: D8911.id21146.diff
Sat, Mar 15, 3:46 AM
F15350797: D8911.diff
Mon, Mar 10, 3:25 PM
F15348453: D8911.diff
Mon, Mar 10, 2:31 PM
F15345853: D8911.diff
Mon, Mar 10, 12:55 PM
F15345735: D8911.diff
Mon, Mar 10, 12:08 PM
F15345585: D8911.diff
Mon, Mar 10, 11:33 AM
Subscribers

Details

Reviewers
btrahan
Maniphest Tasks
T4398: Implement two-factor authentication
Commits
Restricted Diffusion Commit
rP23e654ec2bc8: Rate limit multi-factor actions
Summary

Ref T4398. Prevent users from brute forcing multi-factor auth by rate limiting attempts. This slightly refines the rate limiting to allow callers to check for a rate limit without adding points, and gives users credit for successfully completing an auth workflow.

Test Plan

Tried to enter hisec with bad credentials 11 times in a row, got rate limited.

Diff Detail

Repository
rP Phabricator
Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

epriestley retitled this revision from to Rate limit multi-factor actions.
epriestley updated this object.
epriestley edited the test plan for this revision. (Show Details)
epriestley added a reviewer: btrahan.
btrahan edited edge metadata.
This revision is now accepted and ready to land.Apr 30 2014, 6:32 PM
epriestley updated this revision to Diff 21167.

Closed by commit rP23e654ec2bc8 (authored by @epriestley).