gaschz/trilium
1
0
Fork 0
mirror of https://github.com/zadam/trilium.git synced 2025-03-01 14:22:32 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Rate limit some more ETAPI auth routes; loginRateLimiter now doesn't count successful auth to ETAPI routes

Browse Source
This commit is contained in:
DynamoFox 2022-11-19 18:45:26 +01:00
parent 02d908df1e
commit 059dca905c
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/routes/routes.js
View File

@ -235,7 +235,8 @@ function register(app) {
const loginRateLimiter = rateLimit({
windowMs: 15 * 60 * 1000, // 15 minutes
max: 10 // limit each IP to 10 requests per windowMs
max: 10, // limit each IP to 10 requests per windowMs
skipSuccessfulRequests: true // successful auth to rate-limited ETAPI routes isn't counted. However successful auth to /login is still counted!
});
route(POST, '/login', [loginRateLimiter], loginRoute.login);
@ -390,7 +391,7 @@ function register(app) {
apiRoute(GET, '/api/script/relation/:noteId/:relationName', scriptRoute.getRelationBundles);
// no CSRF since this is called from android app
route(POST, '/api/sender/login', [], loginApiRoute.token, apiResultHandler);
route(POST, '/api/sender/login', [loginRateLimiter], loginApiRoute.token, apiResultHandler);
route(POST, '/api/sender/image', [auth.checkEtapiToken, uploadMiddlewareWithErrorHandling], senderRoute.uploadImage, apiResultHandler);
route(POST, '/api/sender/note', [auth.checkEtapiToken], senderRoute.saveNote, apiResultHandler);
@ -410,7 +411,7 @@ function register(app) {
apiRoute(POST, '/api/login/protected/touch', loginApiRoute.touchProtectedSession);
apiRoute(POST, '/api/logout/protected', loginApiRoute.logoutFromProtectedSession);
route(POST, '/api/login/token', [], loginApiRoute.token, apiResultHandler);
route(POST, '/api/login/token', [loginRateLimiter], loginApiRoute.token, apiResultHandler);
// in case of local electron, local calls are allowed unauthenticated, for server they need auth
const clipperMiddleware = utils.isElectron() ? [] : [auth.checkEtapiToken];