brutasse / django-ratelimit-backend

Rate-limit your login attempts at the authentication backend level
https://django-ratelimit-backend.readthedocs.io
BSD 3-Clause "New" or "Revised" License
169 stars 34 forks source link

following example for custom backend: no 'username' in request.POST #43

Open mxork opened 6 years ago

mxork commented 6 years ago

Following https://django-ratelimit-backend.readthedocs.io/en/latest/usage.html#customizing-rate-limiting-criteria

  File "/usr/local/lib/python3.7/site-packages/ratelimitbackend/backends.py", line 33, in authenticate
    counts = self.get_counters(request)
  File "/usr/local/lib/python3.7/site-packages/ratelimitbackend/backends.py", line 60, in get_counters
    return cache.get_many(self.keys_to_check(request))
  File "/usr/local/lib/python3.7/site-packages/ratelimitbackend/backends.py", line 68, in keys_to_check
    ) for minute in range(self.minutes + 1)
  File "/usr/local/lib/python3.7/site-packages/ratelimitbackend/backends.py", line 68, in <listcomp>
    ) for minute in range(self.minutes + 1)
  File ".../settings/ratelimit.py", line 15, in key
    return f'{request.POST[self.username_key][:max_username_length]}-{dt}'
  File "/usr/local/lib/python3.7/site-packages/django/utils/datastructures.py", line 79, in __getitem__
    raise MultiValueDictKeyError(key)
django.utils.datastructures.MultiValueDictKeyError: 'username'

from backends.py/RateLimitMixin:

    def authenticate(self, request=None, **kwargs):
        username = None
        try:
            username = kwargs[self.username_key]
        except KeyError:
            if not self.no_username:
                raise

So username is expected to be passed through **kwargs, not request. Can't make the example work without override-ing authenticate, get_counters, get_cache_key, key.