Add register ratelimit
1 files changed, 15 insertions, 1 deletions
diff --git a/src/api/routes/auth/register.ts b/src/api/routes/auth/register.ts
index 370d7c52..eba86f77 100644
--- a/src/api/routes/auth/register.ts
+++ b/src/api/routes/auth/register.ts
@@ -17,6 +17,7 @@ import {
} from "@fosscord/api";
import bcrypt from "bcrypt";
import { HTTPError } from "lambert-server";
+import { MoreThan } from "typeorm";
const router: Router = Router();
@@ -25,7 +26,7 @@ router.post(
route({ body: "RegisterSchema" }),
async (req: Request, res: Response) => {
const body = req.body as RegisterSchema;
- const { register, security } = Config.get();
+ const { register, security, limits } = Config.get();
const ip = getIpAdress(req);
// email will be slightly modified version of the user supplied email -> e.g. protection against GMail Trick
@@ -198,6 +199,19 @@ router.post(
});
}
+ if (
+ limits.absoluteRate.register.enabled &&
+ (await User.count({ where: { created_at: MoreThan(new Date(Date.now() - limits.absoluteRate.register.window)) } }))
+ >= limits.absoluteRate.register.limit
+ ) {
+ console.log(
+ `Global register ratelimit exceeded for ${getIpAdress(req)}, ${req.body.username}, ${req.body.invite || "No invite given"}`
+ );
+ throw FieldErrors({
+ email: { code: "TOO_MANY_REGISTRATIONS", message: req.t("auth:register.TOO_MANY_REGISTRATIONS") }
+ });
+ }
+
const user = await User.register({ ...body, req });
if (body.invite) {
|
