People ending up brute-force protected when having a conversation open that is being deleted
Open
Nobody has claimed this yet.
bug
feature: conversations 👥
feature: frontend 🖌️
- Dominant language
- PHP
- Stars
- 2.2k
- Forks
- 587
- Avg merge
- 17h 55m
- Merged PRs (30d)
- 350
Description
Happened today with our colleague Alba
[09/Nov/2022:13:59:26 +0000] "POST /ocs/v2.php/apps/spreed/api/v4/room/ABC/participants/active HTTP/1.1" 404 929 "-" "Mozilla/5.0" 33549
[09/Nov/2022:13:59:26 +0000] "GET /ocs/v2.php/apps/spreed/api/v4/room/ABC HTTP/1.1" 404 830 "-" "Mozilla/5.0" 431673
[09/Nov/2022:13:59:39 +0000] "POST /ocs/v2.php/apps/spreed/api/v4/room/ABC/participants/active HTTP/1.1" 404 929 "-" "Mozilla/5.0" 47989
[09/Nov/2022:13:59:40 +0000] "GET /ocs/v2.php/apps/spreed/api/v4/room/ABC HTTP/1.1" 404 868 "-" "Mozilla/5.0" 1635294
[09/Nov/2022:14:00:02 +0000] "POST /ocs/v2.php/apps/spreed/api/v4/room/ABC/participants/active HTTP/1.1" 404 929 "-" "Mozilla/5.0" 39757
[09/Nov/2022:14:00:03 +0000] "GET /ocs/v2.php/apps/spreed/api/v4/room/ABC HTTP/1.1" 404 868 "-" "Mozilla/5.0" 6437726
[09/Nov/2022:14:00:43 +0000] "POST /ocs/v2.php/apps/spreed/api/v4/room/ABC/participants/active HTTP/1.1" 404 929 "-" "Mozilla/5.0" 41701
[09/Nov/2022:14:00:44 +0000] "GET /ocs/v2.php/apps/spreed/api/v4/room/ABC HTTP/1.1" 404 868 "-" "Mozilla/5.0" 50033972
Maybe the bruteforce protection can be tweaked in a way that only different room attempts or passwords end up brute force throttling.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the room API requests shown in the report, especially GET /ocs/v2.php/apps/spreed/api/v4/room/ABC and POST /participants/active, through the brute-force protection handling. Reproduce the repeated 404 requests after a room is deleted and determine whether throttling should distinguish deleted rooms or credentials. Done means the unwanted lockout is prevented and regression coverage verifies the intended throttling behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- api, backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100