antibrute plugin
Massimo Melina committed
Apr 10, 2022 at 22:33 UTC
21c85c3de774da30e7c490737f485c94074d168a
2 files changed
+31
-1
plugins/antibrute/plugin.js
new
+31
@@ -0,0 +1,31 @@
1
+const { API_URI } = require('@hfs/server/src/const')
2
+
3
+exports.version = 1
4
+exports.description = `Introduce increasing delays between login attempts.`
5
+
6
+const INCREMENT = 5_000
7
+const CAP = 60_000
8
+
9
+const LOGIN_URI = API_URI + 'loginSrp1'
10
+const byIp = {}
11
+
12
+exports.init = api => ({
13
+ async middleware(ctx) {
14
+ if (ctx.path !== LOGIN_URI) return
15
+ const k = ctx.ip
16
+ const now = Date.now()
17
+ const rec = byIp[k]
18
+ if (rec) {
19
+ const wait = rec.when - now
20
+ if (wait > 0) {
21
+ console.log('plugin antibrute is delaying', k, 'for', Math.round(wait/1000))
22
+ await new Promise(resolve => setTimeout(resolve, wait))
23
+ }
24
+ ctx.set('x-anti-brute-force', wait)
25
+ }
26
+ const delay = Math.min(CAP, (rec?.delay || 0) + INCREMENT)
27
+ byIp[k] = { delay, when: now + delay }
28
+ setTimeout(() => delete byIp[k], delay * 10) // no memory leak
29
+ }
30
+})
31
+
todo.md
-1
@@ -7,7 +7,6 @@
7
- admin/fs: support insert/delete key
8
- admin/fs: button "copy url to clipboard"
9
- admin/monitor: show some info on what folder is browsing
10
-- anti-brute for logins
10
- admin/stats: total bytes sent
11
- admin/stats: list of IPs seen
12
- if specified config is a folder, check for file config.yaml inside