italia / spid-cie-oidc-django

The SPID/CIE OIDC Federation SDK, written in Python
Apache License 2.0
27 stars 28 forks source link

[Feat] [Provider] Redis Cache to blacklist too many attempts of automatic client registrations #128

Open peppelinux opened 2 years ago

peppelinux commented 2 years ago

each failed trust chain evaluation MUST be stored in a Redist TTL counter The requestor MUST be ignored, until the redis TTL expires, after a threshold of attempts (eg: 5)

this is a mitigation for a evil-subject that inject metadata discovery though automatic client registration using fake trust marks in its entity configuration