fedserv/echo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

services: throttle emailed codes to stop RESEND/RESETPASS email-bombing
All checks were successful
CI / check (push) Successful in 3m46s
Details

Browse source 
REGISTER was rate-limited but RESEND and RESETPASS weren't — anyone could
repeatedly request confirmation/reset codes for any account with an address
on file, flooding the victim's inbox and burning the service's sender
reputation. A per-account 60s cooldown (code_issue_wait, mirroring the vhost
request throttle) now gates both paths; guessing was already infeasible
(2^40 code + 5-try limit), so this closes the abuse, not an auth hole.
This commit is contained in:
Jean Chevronnet 2026-07-16 10:41:52 +00:00
parent 320a591ae3
commit 61005f52f5
No known key found for this signature in database
7 changed files with 44 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/engine/register.rs
View file

@ -175,6 +175,9 @@ impl Engine {
None => resp("error", "ACCOUNT_UNKNOWN", "No such account."),
Some((true, _)) => resp("error", "ALREADY_VERIFIED", "That account is already verified."),
Some((false, None)) => resp("error", "NO_EMAIL", "No email address is on file for that account."),
Some((false, Some(_))) if self.db.code_issue_wait(&account) > 0 => {
resp("error", "TEMPORARILY_UNAVAILABLE", "A code was just sent — please wait a moment before requesting another.")
}
Some((false, Some(addr))) => {
let code = self.db.issue_code(&account, db::CodeKind::Confirm);
let mail = echo_api::email::confirm(self.db.email_brand(), self.db.email_accent(), self.db.email_logo(), &account, &code);