gram-js / gramjs

NodeJS/Browser MTProto API Telegram client library,
MIT License
1.24k stars 176 forks source link

Idea: add fool protection in "start" function to avoid accidental ban for flood #664

Open Lopol2010 opened 5 months ago

Lopol2010 commented 5 months ago

Steps to reproduce:

  1. By accident I made phoneCode callback to always return the same resolved promise.
  2. And did not return true from onError callback.
  3. Then I invalidated code by sending it to my bot's private chat, so that auth.SignIn throws PhoneCodeExpiredError.

In a couple of seconds this combination got my account banned for flood for 1 hour, due to hundreds of signIn attempts before I stopped the server manually.

Relevant while loop: https://github.com/gram-js/gramjs/blob/0471403aa309522ab594d8b67c0bf6cd68ae8feb/gramjs/client/auth.ts#L168-L210

MJBlack9000 commented 2 weeks ago

Have you tried adding a delay in your own code on every retry? If you have a while() loop which has error-handling - it's a good idea to add a delay between retries. So at the end of your while loop, right after the last "catch" clause - just add something like this: await new Promise(resolve => setTimeout(resolve, 5000)); Which would make it wait 5 seconds on every fail. Aka an equivalent of something like asynchio.sleep(5) in python

But overall - if you try to bombard any service with repeated login attempts - you will get limited by that service. I don't think it's anyhow an issue for GramJS devs to deal with. Because Gram.js, like nearly any framework, does exactly what you ask it to do. You'd get the same results with Discord or even normal bot frameworks like Telegraf.js - if you wrote your loop in such a way as to keep constantly trying to login.

Lopol2010 commented 1 week ago

@MJBlack9000, I forgot to mention that this problem occurs in client.start function, which has infinite loops internally, so I had no loops for auth in my app