Repository navigation
Limit password validation attempts per account across OData and local login. - #2250
Merged
Merged
Conversation
VargaJoe
approved these changes
Nov 4, 2026
There was a problem hiding this comment.
🟡 Changes recommended
Custom ILocalAuthenticationUsers providers bypass the shared account-attempt budget, allowing password checks after the budget is exhausted with only per-IP protection remaining.
1 open issue
What changed in this PR
This PR adds a per-account password-check budget shared by OData credential validation and local login, with response timing and generic failures to reduce account enumeration.
Changes:
- Adds a configurable, per-instance sliding-window limiter shared across password-validation paths.
- Introduces randomized response delays and generic account-limit failures while retaining local IP throttling.
- Expands authentication tests and documents configuration, timing, and deployment limits.
| File | Description |
|---|---|
| src/Tests/WebAppTests/ServicesTests.cs | Updates expected authentication service registrations. |
| src/Tests/SenseNet.Services.Core.Tests/PasswordValidationTimingTests.cs | Tests timing, cancellation, and credential outcomes. |
| src/Tests/SenseNet.Services.Core.Tests/PasswordValidationTests.cs | Tests concurrency, expiration, aliases, and shared budgets. |
| src/Tests/SenseNet.Services.Core.Tests/LoginTests.cs | Adapts tests to asynchronous validation and generic failures. |
| src/Tests/SenseNet.Services.Core.Tests/AuthenticationTests.cs | Registers validation services and awaits credential checks. |
| src/Tests/SenseNet.ODataTests/ODataPasswordValidationTests.cs | Tests generic failures and anonymous account throttling. |
| src/Tests/SenseNet.ODataTests/ODataImportTests.cs | Isolates reference-visibility testing from password restrictions. |
| src/Tests/SenseNet.IntegrationTests/TestCases/LocalAuthenticationTestCases.cs | Uses the registered authentication lock. |
| src/Tests/SenseNet.IntegrationTests/InMemTests/InMemLocalAuthenticationTests.cs | Removes the custom in-memory test lock. |
| src/Tests/SenseNet.IntegrationTests.MsSql/MsSqlTests/MsSqlLocalAuthenticationTests.cs | Uses the simplified shared integration test. |
| src/Tests/SenseNet.Authentication.Local.Tests/LocalPasswordValidationTests.cs | Tests shared budgets, generic failures, and instance isolation. |
| src/Tests/SenseNet.Authentication.Local.Tests/LocalPasswordTimingTests.cs | Verifies response delays release authentication locks. |
| src/Tests/SenseNet.Authentication.Local.Tests/LocalAuthenticationTests.cs | Extends pipeline setup and updates throttling expectations. |
| src/Storage/Configuration/IdentityManagement.cs | Clarifies ambiguous-name behavior in documentation. |
| src/Services.Core/ServicesExtensions.cs | Binds options and registers password-validation services. |
| src/Services.Core/Operations/IdentityOperations.cs | Applies asynchronous timing, throttling, and generic failures. |
| src/Services.Core/Authentication/PasswordValidationTiming.cs | Adds randomized credential-response timing. |
| src/Services.Core/Authentication/PasswordValidationThrottledException.cs | Defines throttling errors with retry timing. |
| src/Services.Core/Authentication/PasswordValidationOptions.cs | Defines the configurable account limit. |
| src/Services.Core/Authentication/PasswordValidationLimiter.cs | Implements atomic sliding-window attempt tracking. |
| src/Services.Core/Authentication/AuthenticationExtensions.cs | Registers and validates shared limiter services. |
| src/OData/ODataMiddleware.cs | Maps uncaught throttling exceptions to HTTP 429. |
| src/OData/ODataException.cs | Adds the HTTP 429 exception mapping. |
| src/Authentication.Local/RepositoryLocalUsers.cs | Reserves shared attempts before password checks. |
| src/Authentication.Local/LocalAuthenticationOptions.cs | Documents the shared account-budget setting. |
| src/Authentication.Local/LocalAuthenticationMiddleware.cs | Returns generic failures for account throttling. |
| src/Authentication.Local/LocalAuthenticationFlows.cs | Adds login timing and updates password validation. |
| src/Authentication.Local/LocalAuthenticationExtensions.cs | Connects local configuration to the shared limiter. |
| docs/local-authentication.md | Documents budgets, timing, configuration, and caller migration. |
Review effort: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Limit password validation attempts per account across OData and local login.