diff options
| author | Patrick Cloke <clokep@users.noreply.github.com> | 2023-02-22 14:37:18 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-02-22 14:37:18 -0500 |
| commit | 4ed08ff72ef8f1abf85ab22de1e51b570f67b27e (patch) | |
| tree | cf00cd5638590b1faac36f90aeb72ee2b6a80ae4 | |
| parent | Use `json.dump` in `FileExfiltrationWriter` (#15095) (diff) | |
| download | synapse-4ed08ff72ef8f1abf85ab22de1e51b570f67b27e.tar.xz | |
Tighten the default rate limit of creating new devices. (#15135)
| -rw-r--r-- | changelog.d/15135.misc | 1 | ||||
| -rw-r--r-- | docs/usage/configuration/config_documentation.md | 6 | ||||
| -rw-r--r-- | synapse/config/ratelimiting.py | 13 |
3 files changed, 15 insertions, 5 deletions
diff --git a/changelog.d/15135.misc b/changelog.d/15135.misc new file mode 100644 index 0000000000..25c4dbffe1 --- /dev/null +++ b/changelog.d/15135.misc @@ -0,0 +1 @@ +Tighten the login ratelimit defaults. diff --git a/docs/usage/configuration/config_documentation.md b/docs/usage/configuration/config_documentation.md index 58c6955689..ab1f9f4963 100644 --- a/docs/usage/configuration/config_documentation.md +++ b/docs/usage/configuration/config_documentation.md @@ -1518,11 +1518,11 @@ rc_registration_token_validity: This option specifies several limits for login: * `address` ratelimits login requests based on the client's IP - address. Defaults to `per_second: 0.17`, `burst_count: 3`. + address. Defaults to `per_second: 0.003`, `burst_count: 5`. * `account` ratelimits login requests based on the account the - client is attempting to log into. Defaults to `per_second: 0.17`, - `burst_count: 3`. + client is attempting to log into. Defaults to `per_second: 0.03`, + `burst_count: 5`. * `failed_attempts` ratelimits login requests based on the account the client is attempting to log into, based on the amount of failed login diff --git a/synapse/config/ratelimiting.py b/synapse/config/ratelimiting.py index 5c13fe428a..b733fac617 100644 --- a/synapse/config/ratelimiting.py +++ b/synapse/config/ratelimiting.py @@ -87,9 +87,18 @@ class RatelimitConfig(Config): defaults={"per_second": 0.1, "burst_count": 5}, ) + # It is reasonable to login with a bunch of devices at once (i.e. when + # setting up an account), but it is *not* valid to continually be + # logging into new devices. rc_login_config = config.get("rc_login", {}) - self.rc_login_address = RatelimitSettings(rc_login_config.get("address", {})) - self.rc_login_account = RatelimitSettings(rc_login_config.get("account", {})) + self.rc_login_address = RatelimitSettings( + rc_login_config.get("address", {}), + defaults={"per_second": 0.003, "burst_count": 5}, + ) + self.rc_login_account = RatelimitSettings( + rc_login_config.get("account", {}), + defaults={"per_second": 0.003, "burst_count": 5}, + ) self.rc_login_failed_attempts = RatelimitSettings( rc_login_config.get("failed_attempts", {}) ) |