Documentation
¶
Overview ¶
Package authlimit throttles failed authentication attempts by source address.
It exists because two listeners needed the same thing and one of them had nothing. The FHIR server got a limiter when it got authentication; the console login had none at all, and a measurement showed twenty password guesses a second sustained against the administrator account with no delay and no lockout. At that rate a weak password is gone overnight and the only trace is a log full of identical warnings.
Deliberately not a general-purpose rate limiter. It throttles failures, not requests: a busy legitimate client is never affected, and the only thing that accumulates is being wrong.
Index ¶
Constants ¶
const ( DefaultThreshold = 5 DefaultMaxDelay = 5 * time.Minute DefaultMemory = 30 * time.Minute )
Defaults. Five failures before any delay, doubling to a five minute maximum.
Five rather than three, because a person genuinely mistyping a password twice and then getting it right on the third attempt is ordinary, and locking them out would make the limiter the thing people complain about instead of the thing that protects them.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Limiter ¶
type Limiter struct {
// contains filtered or unexported fields
}
Limiter tracks failures per key.
The key is a source address. It is never a username: throttling by username lets anybody lock out a named account by guessing at it deliberately, which turns a protection into a way to deny an administrator access at the moment they need it most.
func (*Limiter) Failed ¶
Failed records a failed attempt and returns how long the key is now blocked for.
func (*Limiter) Succeeded ¶
Succeeded clears a key's history.
Cleared rather than decremented. Somebody who has just proved they hold the right credential is not who this is for, and leaving a count behind would eventually throttle a busy legitimate client that mistyped once an hour ago.
The tradeoff is real and worth naming: a guesser who happens to find a valid credential gets their slate wiped. That matters much less than it sounds, because by then they are in.
Source Files