Implement rate limit on logins

omgnetwork / ewallet

eWallet Backend for the OmiseGO SDKs.

https://omisego.network/

Apache License 2.0

324 stars 74 forks source link

Open mederic-p opened 5 years ago

mederic-p commented 5 years ago

We should have a system to limit the number of login tries with wrong passwords. TODO: Explore different methods

unnawut commented 5 years ago

From team discussion:

We could make a plug for that and plug it into all public endpoints, which should be conveniently grouped as public/authed endpoints already.
Set a new configuration (rate_limit). Have a GenServer running that records requests per IP (?) and start blocking them. This GenServer would be a singleton across the entire cluster.