hasura / hasura/graphql-engine
Add Rate-Limiting for Admin Access with x-hasura-admin-secret
Open
k/enhancement
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
Hasura GraphQL API is vulnerable to brute force attacks designed to learn the admin-secret.
_**Please DENY access for a time period after X many incorrect x-hasura-admin-secret attempts**_
Contributor guide
Research direction
Start by locating the Hasura GraphQL API entry point that validates x-hasura-admin-secret. Clarify the intended values for the failed-attempt threshold and denial period, then define completion as denying access after the threshold and covering the behavior with tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql
- Domain
- api, authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100