Login limit on wrong password. #1043
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
nupur-khare
commented
Oct 3, 2023
nupur-khare
commented
- Fixed VAPT security issue - Login limit to 3 if the password is wrong.
- Fixed test cases.
2. Fixed test cases.
udit-pandey
suggested changes
Oct 4, 2023
| response = client.post( | ||
| "/api/auth/login", | ||
| data={"username": "[email protected]", "password": "Welcome@10"}, | ||
| data={"username": "[email protected]", "password": "Welcome@3010"}, | ||
| ).json() | ||
| print(response) | ||
| assert not response['success'] |
There was a problem hiding this comment.
change message to "Account frozen due to too many unsuccessful login attempts. Please come back in ..... "
| with pytest.raises(AppException, match='Only 3 logins are allowed within 120 minutes. ' | ||
| f'Please come back in *'): | ||
| Authentication.generate_login_tokens(user, True) |
kairon/shared/auth.py
Outdated
| @@ -157,9 +157,10 @@ def create_access_token(*, data: dict, token_type: TOKEN_TYPE = TOKEN_TYPE.LOGIN | |||
| def __authenticate_user(username: str, password: str): | |||
| user = AccountProcessor.get_user_details(username, is_login_request=True) | |||
| if not user or not Utility.verify_password(password, user["password"]): | |||
| UserActivityLogger.is_login_within_cooldown_period(username) | |||
There was a problem hiding this comment.
put this check before retrieving user details
added 2 commits
October 4, 2023 14:00
2. Fixed test cases.
2. Fixed test cases.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.