MFA: SMS code rate limiting (no more than 10 codes per person, per minute)

hanakoa / alpaca

Containerized Go µServices for authentication and authorization.

https://hanakoa.github.io/alpaca/

MIT License

5 stars 0 forks source link

Open kevinmichaelchen opened 6 years ago

kevinmichaelchen commented 6 years ago

Don't transmit more than N SMS messages to personId within the last M minutes.

The table needs to maintain a transmittedAt timestamp.

N and M should be configurable via env vars, with sane defaults.

10 codes in the last 5 minutes is too much.