Skip to content
Snippets Groups Projects
Commit 939003e5 authored by Torben Hansen's avatar Torben Hansen Committed by Benni Mack
Browse files

[FEATURE] Introduce rate limiter for failed logins

The PHP library `symfony/rate-limiter` has been integrated
in order to provide a rate limiting API for the TYPO3 core
and extensions.

As a new system default, the TYPO3 backend and
frontend login now uses a rate limiter, which prevents
further authentication attempts for an IP address, if
a configurable amount of login attempts is
exceeded in a given time.

The hardcoded wait time of 5 seconds after a failed login has
been removed, since it offers no real protection against brute
force attacks.

The following dependencies are introduced:

* symfony/rate-limiter "^5.3"

Resolves: #93825
Releases: master
Change-Id: Ib248b78b501a4d50556aa97938f4c51f12f7522a
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/68624


Tested-by: default avatarcore-ci <typo3@b13.com>
Tested-by: default avatarJochen <rothjochen@gmail.com>
Tested-by: default avatarBenni Mack <benni@typo3.org>
Reviewed-by: default avatarJochen <rothjochen@gmail.com>
Reviewed-by: default avatarBenni Mack <benni@typo3.org>
parent ef218070
Branches
Tags
Showing
with 723 additions and 85 deletions
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment