mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-06 09:09:38 +03:00
Rate limit on password resets #4748
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @KrisLowet on GitHub (May 11, 2024).
Originally assigned to: @ssddanbrown on GitHub.
Describe the feature you'd like
Currently, there is no rate limit for resetting passwords. Unlimited addresses can be entered.
An idea is to limit the resetting password feature for IP's that requests new passwords for non-existing accounts.
Describe the benefits this would bring to existing BookStack users
More security due to blocking malafide requests.
Can the goal of this request already be achieved via other means?
A captcha method.
Logging resets for unknown emails addresses (like logging failed access) to block the IP via failed2ban.
Have you searched for an existing open/closed issue?
How long have you been using BookStack?
1 to 5 years
Additional context
No response