element-hq / element-hq/synapse
Out of the box, throttle new account registrations
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
This issue has been migrated from [#10320](https://github.com/matrix-org/synapse/issues/10320).
---
A simple measure could decrease the ability for malicious users to DDoS federation: throttling new account registrations.
Example behaviour
1. Add a configuration to homeserver.yaml, e.g. `max_registrations_per_minute`, defaulting to 1.
2. When the total number of registrations during e.g. the last minute is too large, send a "try again later" message.
3. Servers that wish to offer public registrations to numerous users can of course customize this value or make it infinite.
This may require:
1. A new error code `M_SERVER_BUSY`;
2. Adapting the UX of clients to make the problem explicit.
Contributor guide
Assessment
This issue has not been assessed yet.