Add rate limit on auth routes

packages/strapi-admin/package.json

@@ -51,4 +51,4 @@
     "npm": ">= 5.0.0"
   },
   "license": "MIT"
-}
+}

packages/strapi-email-amazon-ses/package.json

@@ -1,6 +1,6 @@
 {
   "name": "strapi-email-amazon-ses",
-  "version": "3.0.0-alpha.13",
+  "version": "3.0.0-alpha.13.0.1",
   "description": "Amazon SES provider for strapi email",
   "homepage": "http://strapi.io",
   "keywords": [
@@ -42,4 +42,4 @@
     "npm": ">= 5.3.0"
   },
   "license": "MIT"
-}
+}

packages/strapi-email-mailgun/package.json

@@ -42,4 +42,4 @@
     "npm": ">= 5.3.0"
   },
   "license": "MIT"
-}
+}

packages/strapi-email-sendgrid/package.json

@@ -42,4 +42,4 @@
     "npm": ">= 5.3.0"
   },
   "license": "MIT"
-}
+}

packages/strapi-email-sendmail/package.json

@@ -41,4 +41,4 @@
     "npm": ">= 5.3.0"
   },
   "license": "MIT"
-}
+}

packages/strapi-generate-admin/package.json

@@ -42,4 +42,4 @@
     "npm": ">= 5.3.0"
   },
   "license": "MIT"
-}
+}

packages/strapi-generate/package.json

@@ -43,4 +43,4 @@
     "npm": ">= 5.3.0"
   },
   "license": "MIT"
-}
+}

packages/strapi-helper-plugin/package.json

@@ -115,4 +115,4 @@
     "webpack-hot-middleware": "^2.18.2",
     "whatwg-fetch": "^2.0.3"
   }
-}
+}

packages/strapi-hook-knex/package.json

@@ -43,4 +43,4 @@
     "npm": ">= 5.0.0"
   },
   "license": "MIT"
-}
+}

packages/strapi-hook-mongoose/package.json

@@ -45,4 +45,4 @@
     "npm": ">= 5.3.0"
   },
   "license": "MIT"
-}
+}

packages/strapi-hook-redis/package.json

@@ -44,4 +44,4 @@
     "npm": ">= 5.3.0"
   },
   "license": "MIT"
-}
+}

packages/strapi-lint/package.json

@@ -41,4 +41,4 @@
     "babel-eslint": "^8.2.3",
     "prettier": "^1.12.1"
   }
-}
+}

packages/strapi-middleware-views/package.json

@@ -43,4 +43,4 @@
     "npm": ">= 5.3.0"
   },
   "license": "MIT"
-}
+}

packages/strapi-plugin-graphql/package.json

@@ -49,4 +49,4 @@
     "npm": ">= 5.3.0"
   },
   "license": "MIT"
-}
+}

packages/strapi-plugin-users-permissions/admin/src/translations/en.json

@@ -45,6 +45,7 @@
   "Auth.form.error.params.provide": "Incorrect params provided.",
   "Auth.form.error.username.taken": "Username is already taken",
   "Auth.form.error.email.taken": "Email is already taken",
+  "Auth.form.error.ratelimit": "Too many attempts, please try again in a minute.",
 
   "Auth.link.forgot-password": "Forgot your password?",
   "Auth.link.ready": "Ready to sign in?",

packages/strapi-plugin-users-permissions/config/policies/rateLimit.js

@@ -0,0 +1,12 @@
+const RateLimit = require('koa2-ratelimit').RateLimit;
+
+module.exports = async (ctx, next) => {
+  const message = ctx.request.admin ? [{ messages: [{ id: 'Auth.form.error.ratelimit' }] }] : 'Too many attempts, please try again in a minute.';
+
+  return RateLimit.middleware({
+    interval: 1*60*1000,
+    max: 5,
+    prefixKey: `${ctx.request.url}:${ctx.request.ip}`,
+    message
+  })(ctx, next);
+};

packages/strapi-plugin-users-permissions/config/routes.json

@@ -153,7 +153,7 @@
       "path": "/connect/*",
       "handler": "Auth.connect",
       "config": {
-        "policies": [],
+        "policies": ["plugins.users-permissions.ratelimit"],
         "prefix": ""
       }
     },
@@ -162,7 +162,7 @@
       "path": "/auth/local",
       "handler": "Auth.callback",
       "config": {
-        "policies": [],
+        "policies": ["plugins.users-permissions.ratelimit"],
         "prefix": ""
       }
     },
@@ -171,7 +171,7 @@
       "path": "/auth/local/register",
       "handler": "Auth.register",
       "config": {
-        "policies": [],
+        "policies": ["plugins.users-permissions.ratelimit"],
         "prefix": ""
       }
     },
@@ -189,7 +189,7 @@
       "path": "/auth/forgot-password",
       "handler": "Auth.forgotPassword",
       "config": {
-        "policies": [],
+        "policies": ["plugins.users-permissions.ratelimit"],
         "prefix": ""
       }
     },
@@ -198,7 +198,7 @@
       "path": "/auth/reset-password",
       "handler": "Auth.changePassword",
       "config": {
-        "policies": [],
+        "policies": ["plugins.users-permissions.ratelimit"],
         "prefix": ""
       }
     },

packages/strapi-plugin-users-permissions/package.json

@@ -26,6 +26,7 @@
     "grant-koa": "^3.8.1",
     "jsonwebtoken": "^8.1.0",
     "koa": "^2.1.0",
+    "koa2-ratelimit": "^0.6.1",
     "purest": "^2.0.1",
     "request": "^2.83.0",
     "uuid": "^3.1.0"

packages/strapi-plugin-users-permissions/services/Providers.js

@@ -134,7 +134,7 @@ const getProfile = async (provider, query, callback) => {
           callback(err);
         } else {
           // Combine username and discriminator because discord username is not unique
-          var username = body.username + '#' + body.discriminator;
+          var username = `${body.username}#${body.discriminator}`;
           callback(null, {
             username: username,
             email: body.email

packages/strapi-upload-aws-s3/package.json

@@ -43,4 +43,4 @@
     "npm": ">= 5.3.0"
   },
   "license": "MIT"
-}
+}

packages/strapi-upload-cloudinary/package.json

@@ -43,4 +43,4 @@
     "npm": ">= 5.3.0"
   },
   "license": "MIT"
-}
+}

packages/strapi-upload-local/package.json

@@ -39,4 +39,4 @@
     "npm": ">= 5.3.0"
   },
   "license": "MIT"
-}
+}

packages/strapi-upload-rackspace/package.json

@@ -13,4 +13,4 @@
     "pkgcloud": "^1.5.0",
     "streamifier": "^0.1.1"
   }
-}
+}

packages/strapi-utils/package.json

@@ -49,4 +49,4 @@
     "npm": ">= 5.3.0"
   },
   "license": "MIT"
-}
+}

packages/strapi/package.json

@@ -91,4 +91,4 @@
   },
   "preferGlobal": true,
   "license": "MIT"
-}
+}