Expired tokens should not trigger bruteforce protection #12131
Assignees
Labels
Milestone
Comments
rullzer
added
enhancement
1. to develop
|
GitMate.io thinks possibly related issues are #11104 (Expire tokens hardening), #11103 ([stable14] Expire tokens hardening), #12130 (Reset bruteforce on token refresh OAuth), #3156 (Clear bruteforce protection from user upon successful login), and #2626 (Add bruteforce protection to two factor challenge endpoint). |
|
Yes, those are false positives. Also, as the (attempted, invalid) token is pretty much the same every time this would be a very stupid brute force attempt ;) |
rullzer
added a commit
that referenced
this issue
Oct 30, 2018
Fixes #12131 If we hit an expired token there is no need to continue checking. Since we know it is a token. We also should not register this with the bruteforce throttler as it is actually a valid token. Just expired. Instead the authentication should fail. And buisness continues as usual. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
rullzer
added a commit
that referenced
this issue
Oct 30, 2018
Fixes #12131 If we hit an expired token there is no need to continue checking. Since we know it is a token. We also should not register this with the bruteforce throttler as it is actually a valid token. Just expired. Instead the authentication should fail. And buisness continues as usual. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
rullzer
added a commit
that referenced
this issue
Oct 30, 2018
Fixes #12131 If we hit an expired token there is no need to continue checking. Since we know it is a token. We also should not register this with the bruteforce throttler as it is actually a valid token. Just expired. Instead the authentication should fail. And buisness continues as usual. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Dagefoerde
pushed a commit
to Dagefoerde/server
that referenced
this issue
Oct 31, 2018
Fixes nextcloud#12131 If we hit an expired token there is no need to continue checking. Since we know it is a token. We also should not register this with the bruteforce throttler as it is actually a valid token. Just expired. Instead the authentication should fail. And buisness continues as usual. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Dagefoerde
pushed a commit
to Dagefoerde/server
that referenced
this issue
Oct 31, 2018
Fixes nextcloud#12131 If we hit an expired token there is no need to continue checking. Since we know it is a token. We also should not register this with the bruteforce throttler as it is actually a valid token. Just expired. Instead the authentication should fail. And buisness continues as usual. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
rullzer
added a commit
that referenced
this issue
Nov 2, 2018
Fixes #12131 If we hit an expired token there is no need to continue checking. Since we know it is a token. We also should not register this with the bruteforce throttler as it is actually a valid token. Just expired. Instead the authentication should fail. And buisness continues as usual. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
When a token expires (for example OAuth tokens) and authentication is attempted with it we fail.
This is fine as authentication should fail with expired tokens.
However we should not register this as a bruteforce attempts. As it is actually not that.
CC: @ChristophWurst @Dagefoerde
The text was updated successfully, but these errors were encountered: