starred/pocket-id-pocket-id-1
1
0
Fork 0
mirror of https://github.com/pocket-id/pocket-id.git synced 2025-12-09 14:53:00 +03:00
Code Issues 122 Packages Projects Releases 10 Wiki Activity

🚀 Feature: rate limit brute force protection #57

New Issue
Closed
opened 2025-10-07 23:51:12 +03:00 by OVERLORD · 1 comment
OVERLORD commented 2025-10-07 23:51:12 +03:00
Owner
Copy Link

Originally created by @lordraiden on GitHub.

Feature description

A determined attacker can spam the /api/webauthn/login/finish endpoint with millions of crafted assertions, trying to:trigger the passkey device repeatedly (DoS against the user’s phone/YubiKey), orfind implementation bugs (signature malleability, TOFU downgrades, etc.)

With a SQLite backend by default each failed assertion = 1 DB write. A trivial for loop can fill the disk or exhaust IOPS.

Current code ( backend/internal/handler/webauthn.go ) returns 400/401 on failure but does not count or block. No metrics, no logs with IP/user correlation.

Pitch

This is the technical proposal of AI in case it could be helpful

https://chatgpt.com/s/t_68b1c2af33f08191a31f4625b54dc757

Originally created by @lordraiden on GitHub. ### Feature description A determined attacker can spam the /api/webauthn/login/finish endpoint with millions of crafted assertions, trying to:trigger the passkey device repeatedly (DoS against the user’s phone/YubiKey), orfind implementation bugs (signature malleability, TOFU downgrades, etc.) With a SQLite backend by default each failed assertion = 1 DB write. A trivial for loop can fill the disk or exhaust IOPS. Current code ( backend/internal/handler/webauthn.go ) returns 400/401 on failure but does not count or block. No metrics, no logs with IP/user correlation. ### Pitch This is the technical proposal of AI in case it could be helpful https://chatgpt.com/s/t_68b1c2af33f08191a31f4625b54dc757
OVERLORD commented 2025-10-07 23:51:14 +03:00
Author
Owner
Copy Link

@stonith404 commented on GitHub:

We already have a global rate limiter and specific limits for critical endpoints. See here:
4a1e116b81/backend/internal/controller/webauthn_controller.go (L24)

@stonith404 commented on GitHub: We already have a global rate limiter and specific limits for critical endpoints. See here: https://github.com/pocket-id/pocket-id/blob/4a1e116b814b2ca6d7b8728b40db2e86f3482ee5/backend/internal/controller/webauthn_controller.go#L24
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
breaking
bug
documentation
feature
needs more upvotes
open to pull requests
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/pocket-id-pocket-id-1#57
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?