feat(auth): per-account brute-force lockout with exponential backoff
Existing protection was per-IP only (login_attempts table). On a loopback
deployment everyone hits 127.0.0.1, so the per-IP counter is mostly
ornamental — the real attacker is on the same machine. Adds a second
defense layer that tracks failures per username with an exponential
backoff schedule.
Schema:
account_lockouts (username TEXT PK, failed_count INT,
locked_until DATETIME, last_attempt_at, last_attempt_ip)
Backoff after threshold (4+ failures):
1, 2, 3 failures → no lockout (grace window for typos)
4th → 60 s
5th → 5 min
6th → 15 min
7th → 1 h
8th → 6 h
9th and beyond → 24 h (capped)
Counter resets to 0 on successful login or reauth. Old non-locked rows
older than 30 days are pruned by CleanupExpired alongside the existing
sessions / audit_log / login_attempts cleanups.
Wiring:
- HandleLogin / HandleReauth both check RejectIfAccountLocked() before
touching the users table. Lockout responses are 429 with JSON body
{ error, retry_after } and a Retry-After header.
- Failed attempts are recorded against the username even when the user
doesn't exist, preventing account enumeration via differential
"is this account locked?" probes.
- PBKDF2 hash comparison was already constant-time (ConstantTimeEquals);
no change there.
Client (js/app.js):
- api() now preserves response status + body on Error so callers can
distinguish 429-lockout from other errors.
- New showLockoutCountdown(seconds) renders a live "Account locked —
try again in Xm Ys" message in #authHint, disables #loginBtn until
the countdown reaches 0, then re-enables it.
- doLogin / doUnlock both branch on err.status === 429 + retry_after
to call showLockoutCountdown instead of a generic error toast.
Known limitation: an attacker can DoS-lock arbitrary usernames by
spamming /login with that name. This is intentional — the alternative
(per-(username,IP) tracking) would let attackers enumerate accounts.
DoS-lock is acceptable; auth bypass is not.
This commit is contained in:
@@ -1,21 +1,58 @@
|
||||
unit PM.RateLimit;
|
||||
|
||||
{
|
||||
Mirrors api.php checkRateLimit / recordAttempt / clearAttempts.
|
||||
15-minute window. Caller decides the threshold (5 for register, 10 for login).
|
||||
Two-layer brute-force protection:
|
||||
|
||||
1) Per-IP rate limit (login_attempts table, 15-minute window).
|
||||
Useful for non-loopback deployments and as a defense-in-depth layer.
|
||||
|
||||
2) Per-username lockout (account_lockouts table, exponential backoff).
|
||||
The real defense for a loopback-only setup where everyone shares
|
||||
127.0.0.1. After 4 consecutive failed attempts for a given username,
|
||||
the account is locked for an increasing duration (1m, 5m, 15m, 1h,
|
||||
6h, 24h-capped). Counter resets on successful authentication.
|
||||
|
||||
IMPORTANT: failed attempts are recorded even when the username doesn't
|
||||
exist in the users table. This prevents attackers from enumerating
|
||||
existing accounts by observing which usernames trigger a lockout.
|
||||
Trade-off: an attacker can DoS-lock arbitrary usernames, but they can
|
||||
never bypass authentication this way.
|
||||
}
|
||||
|
||||
interface
|
||||
|
||||
uses
|
||||
System.SysUtils, FireDAC.Comp.Client, FireDAC.Stan.Param, IdCustomHTTPServer,
|
||||
System.SysUtils, System.JSON,
|
||||
FireDAC.Comp.Client, FireDAC.Stan.Param, IdCustomHTTPServer,
|
||||
PM.Database;
|
||||
|
||||
function GetClientIP(ARequest: TIdHTTPRequestInfo): string;
|
||||
|
||||
// ---- Per-IP rate limit (legacy) ----
|
||||
function CheckRateLimit(const AIP: string): Integer;
|
||||
procedure RecordAttempt(const AIP: string);
|
||||
procedure ClearAttempts(const AIP: string);
|
||||
|
||||
// ---- Per-username account lockout ----
|
||||
|
||||
// Seconds remaining until the account is unlocked. 0 means not locked.
|
||||
function GetAccountLockoutRemaining(const AUsername: string): Integer;
|
||||
|
||||
// Records a failed authentication attempt against AUsername (whether or not
|
||||
// the user exists), applies exponential backoff, and returns the new
|
||||
// failed_count. Caller should pass this back to the audit log.
|
||||
function RecordFailedAccountAttempt(const AUsername, AIP: string): Integer;
|
||||
|
||||
// Resets the failed counter and clears any lockout for AUsername. Call on
|
||||
// successful login / reauth.
|
||||
procedure ClearAccountLockout(const AUsername: string);
|
||||
|
||||
// One-stop helper for handlers: if the account is currently locked, sends
|
||||
// a 429 with a JSON body { error, retry_after } and returns True. Caller
|
||||
// should Exit immediately. Returns False if not locked (caller proceeds).
|
||||
function RejectIfAccountLocked(AResponse: TIdHTTPResponseInfo;
|
||||
const AUsername: string): Boolean;
|
||||
|
||||
implementation
|
||||
|
||||
function GetClientIP(ARequest: TIdHTTPRequestInfo): string;
|
||||
@@ -91,4 +128,180 @@ begin
|
||||
end;
|
||||
end;
|
||||
|
||||
// =============================================================================
|
||||
// Per-username lockout with exponential backoff
|
||||
// =============================================================================
|
||||
|
||||
// Exponential backoff schedule. Index = failed_count value AFTER this attempt.
|
||||
// First 3 failures give no lockout — a real user typing their master pw
|
||||
// wrong once or twice shouldn't be punished. From the 4th failure on, the
|
||||
// duration ramps up sharply. Capped at 24 h regardless of further failures.
|
||||
function ComputeBackoffSeconds(AFailedCount: Integer): Integer;
|
||||
begin
|
||||
case AFailedCount of
|
||||
0..3: Result := 0; // grace window
|
||||
4: Result := 60; // 1 minute
|
||||
5: Result := 300; // 5 minutes
|
||||
6: Result := 900; // 15 minutes
|
||||
7: Result := 3600; // 1 hour
|
||||
8: Result := 21600; // 6 hours
|
||||
else
|
||||
Result := 86400; // 24 hours — capped, regardless of count
|
||||
end;
|
||||
end;
|
||||
|
||||
function GetAccountLockoutRemaining(const AUsername: string): Integer;
|
||||
var
|
||||
LQ: TFDQuery;
|
||||
begin
|
||||
Result := 0;
|
||||
if AUsername = '' then Exit;
|
||||
|
||||
DB.Lock;
|
||||
try
|
||||
LQ := TFDQuery.Create(nil);
|
||||
try
|
||||
LQ.Connection := DB.Connection;
|
||||
// CAST(strftime(...) - strftime(...) AS INTEGER) gives seconds remaining.
|
||||
// If locked_until is NULL or in the past, the SELECT returns 0.
|
||||
LQ.SQL.Text :=
|
||||
'SELECT MAX(0, CAST(' +
|
||||
' (strftime(''%s'', locked_until) - strftime(''%s'', ''now''))' +
|
||||
' AS INTEGER)) AS remaining ' +
|
||||
'FROM account_lockouts WHERE username = :u';
|
||||
LQ.ParamByName('u').AsString := AUsername;
|
||||
LQ.Open;
|
||||
if not LQ.IsEmpty then
|
||||
Result := LQ.FieldByName('remaining').AsInteger;
|
||||
finally
|
||||
LQ.Free;
|
||||
end;
|
||||
finally
|
||||
DB.Unlock;
|
||||
end;
|
||||
end;
|
||||
|
||||
function RecordFailedAccountAttempt(const AUsername, AIP: string): Integer;
|
||||
var
|
||||
LQ: TFDQuery;
|
||||
LNewCount, LBackoff: Integer;
|
||||
begin
|
||||
Result := 0;
|
||||
if AUsername = '' then Exit;
|
||||
|
||||
DB.Lock;
|
||||
try
|
||||
// Step 1: upsert + increment in a single statement. SQLite's
|
||||
// ON CONFLICT(...) DO UPDATE handles the "row already exists" case
|
||||
// atomically without a separate SELECT/UPDATE race.
|
||||
LQ := TFDQuery.Create(nil);
|
||||
try
|
||||
LQ.Connection := DB.Connection;
|
||||
LQ.SQL.Text :=
|
||||
'INSERT INTO account_lockouts ' +
|
||||
' (username, failed_count, last_attempt_at, last_attempt_ip) ' +
|
||||
'VALUES (:u, 1, CURRENT_TIMESTAMP, :ip) ' +
|
||||
'ON CONFLICT(username) DO UPDATE SET ' +
|
||||
' failed_count = failed_count + 1, ' +
|
||||
' last_attempt_at = CURRENT_TIMESTAMP, ' +
|
||||
' last_attempt_ip = excluded.last_attempt_ip';
|
||||
LQ.ParamByName('u').AsString := AUsername;
|
||||
LQ.ParamByName('ip').AsString := AIP;
|
||||
LQ.ExecSQL;
|
||||
finally
|
||||
LQ.Free;
|
||||
end;
|
||||
|
||||
// Step 2: read the new failed_count and apply backoff if the threshold
|
||||
// is crossed. Done in two queries because SQLite's RETURNING clause
|
||||
// requires 3.35+ and we want to support older versions.
|
||||
LQ := TFDQuery.Create(nil);
|
||||
try
|
||||
LQ.Connection := DB.Connection;
|
||||
LQ.SQL.Text :=
|
||||
'SELECT failed_count FROM account_lockouts WHERE username = :u';
|
||||
LQ.ParamByName('u').AsString := AUsername;
|
||||
LQ.Open;
|
||||
if LQ.IsEmpty then Exit;
|
||||
LNewCount := LQ.FieldByName('failed_count').AsInteger;
|
||||
finally
|
||||
LQ.Free;
|
||||
end;
|
||||
Result := LNewCount;
|
||||
|
||||
LBackoff := ComputeBackoffSeconds(LNewCount);
|
||||
if LBackoff > 0 then
|
||||
begin
|
||||
LQ := TFDQuery.Create(nil);
|
||||
try
|
||||
LQ.Connection := DB.Connection;
|
||||
LQ.SQL.Text :=
|
||||
'UPDATE account_lockouts SET ' +
|
||||
' locked_until = datetime(''now'', ''+'' || :sec || '' seconds'') ' +
|
||||
'WHERE username = :u';
|
||||
LQ.ParamByName('sec').AsInteger := LBackoff;
|
||||
LQ.ParamByName('u').AsString := AUsername;
|
||||
LQ.ExecSQL;
|
||||
finally
|
||||
LQ.Free;
|
||||
end;
|
||||
end;
|
||||
finally
|
||||
DB.Unlock;
|
||||
end;
|
||||
end;
|
||||
|
||||
procedure ClearAccountLockout(const AUsername: string);
|
||||
var
|
||||
LQ: TFDQuery;
|
||||
begin
|
||||
if AUsername = '' then Exit;
|
||||
|
||||
DB.Lock;
|
||||
try
|
||||
LQ := TFDQuery.Create(nil);
|
||||
try
|
||||
LQ.Connection := DB.Connection;
|
||||
// Hard delete on success: keeps the table small, and there's no
|
||||
// value in remembering past failures once the user has proven they
|
||||
// know the password.
|
||||
LQ.SQL.Text := 'DELETE FROM account_lockouts WHERE username = :u';
|
||||
LQ.ParamByName('u').AsString := AUsername;
|
||||
LQ.ExecSQL;
|
||||
finally
|
||||
LQ.Free;
|
||||
end;
|
||||
finally
|
||||
DB.Unlock;
|
||||
end;
|
||||
end;
|
||||
|
||||
function RejectIfAccountLocked(AResponse: TIdHTTPResponseInfo;
|
||||
const AUsername: string): Boolean;
|
||||
var
|
||||
LRemaining: Integer;
|
||||
LBody: TJSONObject;
|
||||
begin
|
||||
LRemaining := GetAccountLockoutRemaining(AUsername);
|
||||
Result := LRemaining > 0;
|
||||
if not Result then Exit;
|
||||
|
||||
// 429 Too Many Requests with a structured body so the client can show
|
||||
// a countdown timer ("Try again in X seconds") instead of a generic
|
||||
// error toast. Standard Retry-After header included as a fallback for
|
||||
// HTTP-aware tooling.
|
||||
AResponse.ResponseNo := 429;
|
||||
AResponse.ContentType := 'application/json; charset=utf-8';
|
||||
AResponse.CustomHeaders.Values['Retry-After'] := IntToStr(LRemaining);
|
||||
|
||||
LBody := TJSONObject.Create;
|
||||
try
|
||||
LBody.AddPair('error', 'Account temporarily locked due to repeated failed attempts');
|
||||
LBody.AddPair('retry_after', TJSONNumber.Create(LRemaining));
|
||||
AResponse.ContentText := LBody.ToJSON;
|
||||
finally
|
||||
LBody.Free;
|
||||
end;
|
||||
end;
|
||||
|
||||
end.
|
||||
|
||||
Reference in New Issue
Block a user