element-hq / element-hq/element-web
🐛 polling in registration flow leads to firewall bans on homeservers
- Dominant language
- TypeScript
- Stars
- 13.5k
- Forks
- 2.8k
- PR merge metrics
- PR metrics pending
Description
### Steps to reproduce
1. Run a firewall on your Homeserver (e.g. using CrowdSec or fail2ban)
2. Open Element Client
3. Set your Homeservers Endpoint
4. Create New Account
5. Enter Registration Token
6. Press Register
### Outcome
#### What did you expect?
The registration to succeed.
#### What happened instead?
You are IP banned from the Homeserver.
---
Hello everyone 👋
I discovered a major issue today when using element-web as a client against homeserver instances protected by firewall tooling such as fail2ban or CrowdSec.
While entering the `REGISTRATION_TOKEN`, the app polls the server’s registration endpoint every two seconds, despite the user not having pressed the `Register` button yet. This behavior triggers firewall rules intended to prevent brute-force attacks, causing the user’s IP address to be blocked before any actual registration occurs.
This PR (#31629) removes the unnecessary polling logic, preventing premature IP bans and allowing token-based registration to proceed as expected.
Best regards,
@lukas-runge
---
### Operating system
MacOS
### Browser information
Zen
### URL for webapp
/#/register
### Application version
7398a83ae4b4d8f656dea3952e0f72c0cfc3ea6e
### Homeserver
Private Homeserver using Tuwunel
### Will you send logs?
No
Contributor guide
Assessment
This issue has not been assessed yet.