Unfloyded/Legamunt
0
0
Fork 0
Code Activity

Fix: remove broken OAuth Application vacuuming & throttle OAuth Application registrations (#30316)

Browse source 
Co-authored-by: Claire <claire.github-309c@sitedethib.com>
This commit is contained in:
Emelia Smith 2024-05-29 16:00:05 +02:00 • committed by GitHub
parent 6eea83211c
commit d20a5c3ec9
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
5 changed files with 22 additions and 63 deletions
Download patch file Download diff file Expand all files Collapse all files

18
spec/config/initializers/rack/attack_spec.rb
View file

@ -131,4 +131,22 @@ describe Rack::Attack, type: :request do
it_behaves_like 'throttled endpoint'
end
end
describe 'throttle excessive oauth application registration requests by IP address' do
let(:throttle) { 'throttle_oauth_application_registrations/ip' }
let(:limit) { 5 }
let(:period) { 10.minutes }
let(:path) { '/api/v1/apps' }
let(:params) do
{
client_name: 'Throttle Test',
redirect_uris: 'urn:ietf:wg:oauth:2.0:oob',
scopes: 'read',
}
end
let(:request) { -> { post path, params: params, headers: { 'REMOTE_ADDR' => remote_ip } } }
it_behaves_like 'throttled endpoint'
end
end