dbeaver / dbeaver/cloudbeaver

Brute force not behave correctly

Open
#3,045 12 comments 0 reactions 1 assignee Assigned to @yagudin10 View on GitHub
wontfix xf:authentication xf:local config
Dominant language
TypeScript
Stars
5.1k
Forks
563
Avg merge
3d 9h
Merged PRs (30d)
59

Description

**Describe the bug**
I had configured my cloudbeaver with the env variable in docker
```
- name: CLOUDBEAVER_BRUTE_FORCE_PROTECTION_ENABLED
value: "true"
- name: CLOUDBEAVER_MAX_FAILED_LOGINS
value: "3"
- name: CLOUDBEAVER_MINIMUM_LOGIN_TIMEOUT
value: "1"
- name: CLOUDBEAVER_BLOCK_PERIOD
value: "30"
```
With CLOUDBEAVER_MINIMUM_LOGIN_TIMEOUT = 1, according to the code in repo, this should be last login attempt within 1second.
Once I logout, try to login again i will hit the exception
```
org.jkiss.dbeaver.DBException: Too frequent authentication requests
at io.cloudbeaver.service.security.bruteforce.BruteForceUtils.checkLoginInterval(BruteForceUtils.java:65)
at io.cloudbeaver.service.security.bruteforce.BruteForceUtils.checkBruteforce(BruteForceUtils.java:40)
at io.cloudbeaver.service.security.CBEmbeddedSecurityController.createNewAuthAttempt(CBEmbeddedSecurityController.java:1620)
at io.cloudbeaver.service.security.CBEmbeddedSecurityController.authenticate(CBEmbeddedSecurityController.java:1541)
at io.cloudbeaver.service.auth.impl.WebServiceAuthImpl.authLogin(WebServiceAuthImpl.java:92)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
```

**To Reproduce**
Steps to reproduce the behavior:
1. Login to CloudBeaver
2. Logout
3. Try to login again
4. See error

**Screenshots**
If applicable, add screenshots to help explain your problem.
![image](https://github.com/user-attachments/assets/da38380f-ee83-4b67-91d9-f6b4874417ef)

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.