From ec4a099f182629d86a7421af7d4899a655be684e Mon Sep 17 00:00:00 2001
From: 0livd <github@destras.fr>
Date: Sun, 20 Aug 2017 12:37:12 +0200
Subject: Protect admin endpoints against brute force attacks (#249)

* Protect admin endpoints against brute force attacks

Add a throttling mechanism to prevent a client brute
forcing the authentication form, based on its ip address
Closes #245

* Reset attempt counters if they get memory hungry
---
 ihatemoney/tests/tests.py | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

(limited to 'ihatemoney/tests/tests.py')

diff --git a/ihatemoney/tests/tests.py b/ihatemoney/tests/tests.py
index 5fc45a7..86f11f3 100644
--- a/ihatemoney/tests/tests.py
+++ b/ihatemoney/tests/tests.py
@@ -9,6 +9,7 @@ import os
 import json
 from collections import defaultdict
 import six
+from time import sleep
 
 from werkzeug.security import generate_password_hash
 from flask import session
@@ -397,6 +398,28 @@ class BudgetTestCase(IhatemoneyTestCase):
         resp = self.client.post("/admin?goto=%2Fcreate", data={'admin_password': ''})
         self.assertNotIn('<a href="/create">/create</a>', resp.data.decode('utf-8'))
 
+    def test_login_throttler(self):
+        self.app.config['ADMIN_PASSWORD'] = generate_password_hash("pass")
+
+        # Authenticate 3 times with a wrong passsword
+        self.client.post("/admin?goto=%2Fcreate", data={'admin_password': 'wrong'})
+        self.client.post("/admin?goto=%2Fcreate", data={'admin_password': 'wrong'})
+        resp = self.client.post("/admin?goto=%2Fcreate", data={'admin_password': 'wrong'})
+
+        self.assertIn('Too many failed login attempts, please retry later.',
+                      resp.data.decode('utf-8'))
+        # Change throttling delay
+        import gc
+        for obj in gc.get_objects():
+            if isinstance(obj, utils.LoginThrottler):
+                obj._delay = 0.005
+                break
+        # Wait for delay to expire and retry logging in
+        sleep(1)
+        resp = self.client.post("/admin?goto=%2Fcreate", data={'admin_password': 'wrong'})
+        self.assertNotIn('Too many failed login attempts, please retry later.',
+                         resp.data.decode('utf-8'))
+
     def test_manage_bills(self):
         self.post_project("raclette")
 
-- 
cgit v1.1