search

franklindyer / agora-app

Simple and (hopefully) secure social media application. Also a project for spring 2024 CS 444 cybersecurity class at UNM.
4 stars 1 forks source link

There should be a rate limit on password resets #100

Open altheaden opened 6 months ago

altheaden commented 6 months ago

After a certain number of requested password reset emails, a person should have to put in their recovery code to get another email. This is to prevent DoS attacks on a user with a known email.

franklindyer commented 6 months ago

How about just a minimum amount of time before requesting another recovery code to the same email? And perhaps a captcha on the password reset page to prevent bot spamming?