mirror of
https://github.com/zitadel/zitadel.git
synced 2025-12-24 03:57:13 +00:00
d3713dfaed
# Which Problems Are Solved
While the lockout policy was correctly applied on the session API and other authentication and management endpoints , it had no effect on the user service v2 endpoints.
# How the Problems Are Solved
- Correctly apply lockout policy on the user service v2 endpoints.
- Added tar pitting to auth factor checks (authentication and management API) to prevent brute-force attacks or denial of service because of user lockouts.
- Tar pitting is not active if `IgnoreUnknownUsername` option is active to prevent leaking information whether a user exists or not.
# Additional Changes
None
# Additional Context
- requires backports
* cleanup
(cherry picked from commit b8db8cdf9c)
84 lines
1.6 KiB
Go
84 lines
1.6 KiB
Go
package systemdefaults
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestTarpitConfig_duration(t *testing.T) {
|
|
type fields struct {
|
|
MinFailedAttempts uint64
|
|
StepDuration time.Duration
|
|
StepSize uint64
|
|
MaxDuration time.Duration
|
|
}
|
|
type args struct {
|
|
failedCount uint64
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
fields fields
|
|
args args
|
|
want time.Duration
|
|
}{
|
|
{
|
|
"no tarpit",
|
|
fields{
|
|
MinFailedAttempts: 2,
|
|
StepDuration: time.Second,
|
|
StepSize: 1,
|
|
MaxDuration: 5 * time.Second,
|
|
},
|
|
args{failedCount: 1},
|
|
0,
|
|
},
|
|
{
|
|
"first step",
|
|
fields{
|
|
MinFailedAttempts: 2,
|
|
StepDuration: time.Second,
|
|
StepSize: 1,
|
|
MaxDuration: 5 * time.Second,
|
|
},
|
|
args{failedCount: 3},
|
|
time.Second,
|
|
},
|
|
{
|
|
"second step",
|
|
fields{
|
|
MinFailedAttempts: 2,
|
|
StepDuration: time.Second,
|
|
StepSize: 1,
|
|
MaxDuration: 5 * time.Second,
|
|
},
|
|
args{failedCount: 4},
|
|
2 * time.Second,
|
|
},
|
|
{
|
|
"exceeding max duration",
|
|
fields{
|
|
MinFailedAttempts: 2,
|
|
StepDuration: time.Second,
|
|
StepSize: 1,
|
|
MaxDuration: 5 * time.Second,
|
|
},
|
|
args{failedCount: 20},
|
|
5 * time.Second,
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
c := &TarpitConfig{
|
|
MinFailedAttempts: tt.fields.MinFailedAttempts,
|
|
StepDuration: tt.fields.StepDuration,
|
|
StepSize: tt.fields.StepSize,
|
|
MaxDuration: tt.fields.MaxDuration,
|
|
}
|
|
got := c.duration(tt.args.failedCount)
|
|
assert.Equal(t, tt.want, got)
|
|
})
|
|
}
|
|
}
|