express-brute
express-brute copied to clipboard
AdamPflug
Ability to query status without incrementing
I have a server where clients authenticate themselves with tokens. I want to make sure, nobody tries sending random tokens to find a working one. Random is the keyword, as I want to allow multiple requests using the same valid token. I cannot just reset upon a valid token as the attacker could easily create a token for itself, try breaking in but at the last attempt before protection kicks in use its valid token.
My solution would be: 1: query if I can check that the token is valid 1.1: if I can't, just reject the request 1.2: if I can, check that the token is valid 1.2.1: if valid, allow in, do nothing with the brute 1.2.2: if isn't valid, increment the brute counter
tl;dr: I would like to method where I can just query the state and I would like to manually increment the request count.
My first inclination was to have a .decrement method that you could call instead of .reset on valid requests - but two trips to the persistent store is a bit messy. Maybe a better option is just letting you specify a autoincrement: false or something, then have an increment method you could call manually. Let me noodle on this a bit more and see if I can come up with a better solution.
@AdamPflug
Just wanted to chime in here with my 2 pennies.
First off this package is SUPER TERRIFIC!
and then some thoughts on this issue with responses.
two trips to the persistent store is a bit messy
Agreed.
Maybe a better option is just letting you specify a
autoincrement: falseor something, then have anincrementmethod you could call manually.
We could benefit from this as a pre-filter option (on routing)... although we're probably going to put something before express-brute as that pre-filter... but this would add to this packages already flexible nature if added.
Thank you from the entire OUJS team for your great contribution!
@AdamPflug have you ever implemented the autoincrement option along side with the increment method?
@AdamPflug
My first inclination was to have a .decrement method that you could call instead of .reset on valid requests - but two trips to the persistent store is a bit messy. Maybe a better option is just letting you specify a autoincrement: false or something, then have an increment method you could call manually. Let me noodle on this a bit more and see if I can come up with a better solution.
was this implemented ?
