Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

663: Protect pw reset mail #1526

Merged
merged 5 commits into from
Jul 3, 2024
Merged

663: Protect pw reset mail #1526

merged 5 commits into from
Jul 3, 2024

Conversation

f1sh1918
Copy link
Contributor

@f1sh1918 f1sh1918 commented Jul 2, 2024

Short description

Since password reset is not behind a login and can be triggered easily, this api interactions should be protected

Proposed changes

  • write to log if an unknown user(mail address) requests a password reset mail
  • write to log if an reset password fails
  • this log will be checked from fail2ban (check related pr)

Side effects

  • no

Resolved issues

Fixes: #663
related to : https://git.tuerantuer.org/DF/salt/pulls/187

@f1sh1918 f1sh1918 marked this pull request as ready for review July 2, 2024 09:24
@f1sh1918 f1sh1918 changed the title 663: log password reset mail attempt with wrong mail address 663: Protect pw reset mail Jul 2, 2024
f1sh1918 and others added 3 commits July 3, 2024 15:26
…vice/schema/ResetPasswordMutationService.kt

Co-authored-by: Michael Markl <marklmichael98@gmail.com>
…vice/schema/ResetPasswordMutationService.kt

Co-authored-by: Michael Markl <marklmichael98@gmail.com>
…vice/schema/ResetPasswordMutationService.kt

Co-authored-by: Michael Markl <marklmichael98@gmail.com>
@f1sh1918 f1sh1918 enabled auto-merge July 3, 2024 13:27
@f1sh1918 f1sh1918 merged commit fa4da33 into main Jul 3, 2024
1 check passed
@f1sh1918 f1sh1918 deleted the 663-protect-pw-reset-mail branch July 3, 2024 13:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Protect more API interactions with IP blocking
2 participants