Add rate limit to basic auth middleware (#5504) * feat: add rate limiting to basic auth flow * fix: round up retry-after duration * feat: enhance point consume logic * fix: move unauthorized webpage reading inside response function * refactor: move getIpAddress to express-common * fix: check for rate limit before checking creds * fix: use correct rate limit pattern in /recover-step2 * feat: handle CF forwarded IP header in rate limit, whitelist and access logger * feat: add individual config toggles for forwarded headers * feat: enhance IP address retrieval to include forwarded IP for access logging * chore: clean-up diff * fix: don't consume points for missing credentials * feat: log rate limited method and URL Co-authored-by: Copilot <copilot@github.com> * feat: make rate limiter points configurable Co-authored-by: Copilot <copilot@github.com> * feat: implement retry-after header for rate limiting responses Co-authored-by: Copilot <copilot@github.com> --------- Co-authored-by: Copilot <copilot@github.com>

b2fa6a0afb2bc859bb2f116232f18035cafebb6d

Cohee <18619528+Cohee1207@users.noreply.github.com>

Signed

Parents: 4ca9863f3809be18e39fc7439be234035f54abeb

default/config.yaml+18 -3 Viewed

 # -- SECURITY CONFIGURATION --
 # Toggle whitelist mode
 whitelistMode: true
 # WhitelistWhen enabled, whitelist will also verify IP in X-Forwarded-Forheaders /enabled X-Real-IPin headers`forwardedHeaders` section.
 enableForwardedWhitelist: true
 # Whitelist of allowed IP addresses
 whitelist:

   minLogLevel: 0
 # -- RATE LIMITING CONFIGURATION --
 rateLimiting:
   # Use X-Real-IPany headerof insteadthe ofenabled socketheaders in the `forwardedHeaders` section to identify the client IP for rate limiting.
 -  # Only enable this if you are using a properly configured reverse proxy (like Nginx/traefik/Caddy)
 +  # If disabled, only the socket IP will be used, which may not work correctly if you are behind a reverse proxy.
   preferRealIpHeader: false
 +  # Set the maximum number of allowed failed basic authentication attempts before rate limiting is applied. Set to 0 to disable rate limiting for basic auth.
 +  basicAuthMaxAttempts: 5
 +  # Set the maximum number of allowed failed account login attempts before rate limiting is applied. Set to 0 to disable rate limiting for account logins.
 +  accountsLoginMaxAttempts: 5
 +  # Set the maximum number of allowed failed account recovery attempts before rate limiting is applied. Set to 0 to disable rate limiting for account recovery.
 +  accountsRecoverMaxAttempts: 5
 +# Set to true to enable support for real IPs in certain request headers for features like IP whitelisting, rate limiting and access logging.
 +# Only change if you are sure that you use a correctly configured reverse proxy, otherwise this may lead to IP spoofing.
 +forwardedHeaders:
 +  # X-Real-IP header (common with Nginx and Caddy)
 +  xRealIp: true
 +  # X-Forwarded-For header (common with many proxies, but may contain multiple IPs - only the first one will be used)
 +  xForwardedFor: true
 +  # CF-Connecting-IP header (used by Cloudflare Tunnels)
 +  cfConnectingIp: false
 ## BACKUP CONFIGURATION
 backups:

src/endpoints/users-public.js+19 -14 Viewed

 import storage from 'node-persist';
 import express from 'express';
 import { RateLimiterMemory, RateLimiterRes } from 'rate-limiter-flexible';
 import { getIpFromRequestgetIpAddress, getRealIpFromHeaderretryAfter } from '../express-common.js';
 import { color, Cache, getConfigValue } from '../util.js';
 import { KEY_PREFIX, getUserAvatar, toKey, getPasswordHash, getPasswordSalt } from '../users.js';
 const DISCREET_LOGIN = getConfigValue('enableDiscreetLogin', false, 'boolean');
 const PREFER_REAL_IP_HEADER = getConfigValue('rateLimiting.preferRealIpHeader', false, 'boolean');
 +const LOGIN_POINTS = getConfigValue('rateLimiting.accountsLoginMaxAttempts', 5, 'number');
 +const RECOVER_POINTS = getConfigValue('rateLimiting.accountsRecoverMaxAttempts', 5, 'number');
 const MFA_CACHE = new Cache(5 * 60 * 1000);
 -const getIpAddress = (request) => PREFER_REAL_IP_HEADER ? getRealIpFromHeader(request) : getIpFromRequest(request);
+-
 export const router = express.Router();
 const loginLimiter = new RateLimiterMemory({
 -    points: 5,
 +    points: LOGIN_POINTS > 0 ? LOGIN_POINTS : Number.MAX_SAFE_INTEGER,
     duration: 60,
 });
 const recoverLimiter = new RateLimiterMemory({
 -    points: 5,
 +    points: RECOVER_POINTS > 0 ? RECOVER_POINTS : Number.MAX_SAFE_INTEGER,
     duration: 300,
 });

             return response.status(400).json({ error: 'Missing required fields' });
+        }
         const ip = getIpAddress(request, PREFER_REAL_IP_HEADER);
         await loginLimiter.consume(ip);
         /** @type {import('../users.js').User} */

         return response.json({ handle: user.handle });
     } catch (error) {
         if (error instanceof RateLimiterRes) {
             console.error('Login failed: Rate limited from', getIpAddress(request, PREFER_REAL_IP_HEADER));
             return retryAfter(response, error).status(429).send({ error: 'Too many attempts. Try again later or recover your password.' });
+        }
         console.error('Login failed:', error);

             return response.status(400).json({ error: 'Missing required fields' });
+        }
         const ip = getIpAddress(request, PREFER_REAL_IP_HEADER);
         await recoverLimiter.consume(ip);
         /** @type {import('../users.js').User} */

         return response.sendStatus(204);
     } catch (error) {
         if (error instanceof RateLimiterRes) {
             console.error('Recover step 1 failed: Rate limited from', getIpAddress(request, PREFER_REAL_IP_HEADER));
             return retryAfter(response, error).status(429).send({ error: 'Too many attempts. Try again later or contact your admin.' });
+        }
         console.error('Recover step 1 failed:', error);

         /** @type {import('../users.js').User} */
         const user = await storage.getItem(toKey(request.body.handle));
         const ip = getIpAddress(request, PREFER_REAL_IP_HEADER);
 +        const rateLimit = await recoverLimiter.get(ip);
++
 +        if (rateLimit !== null && rateLimit.consumedPoints > recoverLimiter.points) {
 +            throw rateLimit;
 +        }
         if (!user) {
             console.error('Recover step 2 failed: User', request.body.handle, 'not found');

         return response.sendStatus(204);
     } catch (error) {
         if (error instanceof RateLimiterRes) {
             console.error('Recover step 2 failed: Rate limited from', getIpAddress(request, PREFER_REAL_IP_HEADER));
             return retryAfter(response, error).status(429).send({ error: 'Too many attempts. Try again later or contact your admin.' });
+        }
         console.error('Recover step 2 failed:', error);

src/express-common.js+53 -7 Viewed

 import ipaddr from 'ipaddr.js';
 import ipMatching from 'ip-matching';
 +import { RateLimiterRes } from 'rate-limiter-flexible';
 +import { getConfigValue } from './util.js';
 const noopMiddleware = (_req, _res, next) => next();
 /** @deprecated Do not use. A global middleware is provided at the application level. */

+}
 /**
 - * Gets the IP address of the client when behind reverse proxy using x-real-ip header, falls back to socket remote address.
 + * Get the client IP address from the request headers.
 - * This function should be used when the application is running behind a reverse proxy (e.g., Nginx, traefik, Caddy...).
 + * @param {import('express').Request} req Express request object
 - * @param {import('express').Request} req Request object
 + * @returns {string|undefined} The client IP address
 - * @returns {string} IP address of the client
  */
 export function getRealIpFromHeadergetRealOrForwardedIp(req) {
 -    if (req.headers['x-real-ip']) {
 +    const xRealIpEnabled = !!getConfigValue('forwardedHeaders.xRealIp', true, 'boolean');
 +    const cfConnectingIpEnabled = !!getConfigValue('forwardedHeaders.cfConnectingIp', false, 'boolean');
 +    const xForwardedForEnabled = !!getConfigValue('forwardedHeaders.xForwardedFor', true, 'boolean');
++
 +    // Check if X-Real-IP is available
 +    if (req.headers['x-real-ip'] && xRealIpEnabled) {
         return req.headers['x-real-ip'].toString();
+    }
 -    return getIpFromRequest(req);
 +    // Check for CF-Connecting-IP (Cloudflare) if available
 +    if (req.headers['cf-connecting-ip'] && cfConnectingIpEnabled) {
 +        return req.headers['cf-connecting-ip'].toString();
 +    }
++
 +    // Check for X-Forwarded-For and parse if available
 +    if (req.headers['x-forwarded-for'] && xForwardedForEnabled) {
 +        const ipList = req.headers['x-forwarded-for'].toString().split(',').map(ip => ip.trim());
 +        return ipList[0];
 +    }
++
 +    // If none of the headers are available, return undefined
 +    return undefined;
 +}
++
 +/**
 + * Gets the IP address of the client, optionally including the real/forwarded IP from headers.
 + * Most common use cases: key for rate limiter, logging, etc. where you want to have the real client IP if behind a reverse proxy.
 + * @param {import('express').Request} request Request object
 + * @param {boolean} includeHeaderIp Whether to include the real/forwarded IP from headers
 + * @returns {string} IP address of the client (will include "forwarded" info if includeHeaderIp is true and headers are present)
 + */
 +export function getIpAddress(request, includeHeaderIp) {
 +    const socketIp = getIpFromRequest(request);
 +    const forwardedIp = includeHeaderIp && getRealOrForwardedIp(request);
 +    return forwardedIp ? `${socketIp} (forwarded: ${forwardedIp})` : socketIp;
+}
 /**

     return validEntries;
+}
++
 +/**
 + * Sets the Retry-After header on the response based on the rate limit information.
 + * @param {import('express').Response} response Express response object
 + * @param {RateLimiterRes} rateLimit The rate limit information from rate-limiter-flexible
 + * @returns {import('express').Response} The response object with the Retry-After header set if applicable
 + */
 +export function retryAfter(response, rateLimit) {
 +    if (response.headersSent || !(rateLimit instanceof RateLimiterRes)) {
 +        return response;
 +    }
 +    const retryAfter = Math.ceil(rateLimit.msBeforeNext / 1000);
 +    response.set('Retry-After', retryAfter.toString());
 +    return response;
 +}

src/middleware/accessLogWriter.js+2 -2 Viewed

 import path from 'node:path';
 import fs from 'node:fs';
 import { getRealIpFromHeadergetIpAddress } from '../express-common.js';
 import { color, getConfigValue } from '../util.js';
 const enableAccessLog = getConfigValue('logging.enableAccessLog', true, 'boolean');

  */
 export default function accessLoggerMiddleware() {
     return function (req, res, next) {
         const clientIp = getRealIpFromHeadergetIpAddress(req, true);
         const userAgent = req.headers['user-agent'];
         if (!knownIPs.has(clientIp)) {

src/middleware/basicAuth.js+59 -29 Viewed

 import { Buffer } from 'node:buffer';
 import path from 'node:path';
 import storage from 'node-persist';
 +import { RateLimiterMemory, RateLimiterRes } from 'rate-limiter-flexible';
 import { getAllUserHandles, toKey, getPasswordHash } from '../users.js';
 import { getConfigValue, safeReadFileSync } from '../util.js';
 +import { getIpAddress, retryAfter } from '../express-common.js';
 const PER_USER_BASIC_AUTH = !!getConfigValue('perUserBasicAuth', false, 'boolean');
 const ENABLE_ACCOUNTS = !!getConfigValue('enableUserAccounts', false, 'boolean');
 +const PREFER_REAL_IP_HEADER = !!getConfigValue('rateLimiting.preferRealIpHeader', false, 'boolean');
 +const BASIC_AUTH_ATTEMPTS = getConfigValue('rateLimiting.basicAuthMaxAttempts', 5, 'number');
++
 +const basicAuthLimiter = new RateLimiterMemory({
 +    points: BASIC_AUTH_ATTEMPTS > 0 ? BASIC_AUTH_ATTEMPTS : Number.MAX_SAFE_INTEGER,
 +    duration: 60,
 +});
 const basicAuthMiddleware = async function (request, response, callback) {
 -    const unauthorizedWebpage = safeReadFileSync(path.join(globalThis.DATA_ROOT, '_errors', 'unauthorized.html')) ?? '';
     const unauthorizedResponse = (res) => {
 +        const unauthorizedWebpage = safeReadFileSync(path.join(globalThis.DATA_ROOT, '_errors', 'unauthorized.html')) ?? '';
         res.set('WWW-Authenticate', 'Basic realm="SillyTavern", charset="UTF-8"');
         return res.status(401).send(unauthorizedWebpage);
     };
 -    const basicAuthUserName = getConfigValue('basicAuthUser.username');
 +    try {
             const basicAuthUserPasswordip = getConfigValuegetIpAddress('basicAuthUser.password'request, PREFER_REAL_IP_HEADER);
 -    const authHeader = request.headers.authorization;
 -    if (!authHeader) {
 +        const basicAuthUserName = getConfigValue('basicAuthUser.username');
 -        return unauthorizedResponse(response);
 +        const basicAuthUserPassword = getConfigValue('basicAuthUser.password');
 -    }
 +        const authHeader = request.headers.authorization;
++
 +        if (!authHeader) {
 +            return unauthorizedResponse(response);
 +        }
             const [scheme, credentials] = authHeader.split(' ');
             if (scheme !== 'Basic' || !credentials) {
                     return unauthorizedResponse(response);
+            }
 -    const usePerUserAuth = PER_USER_BASIC_AUTH && ENABLE_ACCOUNTS;
 +        const rateLimit = await basicAuthLimiter.get(ip);
 -    const [username, ...passwordParts] = Buffer.from(credentials, 'base64')
++
 -        .toString('utf8')
 +        if (rateLimit !== null && rateLimit.consumedPoints > basicAuthLimiter.points) {
 -        .split(':');
 +            throw rateLimit;
 -    const password = passwordParts.join(':');
 +        }
 -    if (!usePerUserAuth && username === basicAuthUserName && password === basicAuthUserPassword) {
 +        const usePerUserAuth = PER_USER_BASIC_AUTH && ENABLE_ACCOUNTS;
 -        return callback();
 +        const [username, ...passwordParts] = Buffer.from(credentials, 'base64')
 -    } else if (usePerUserAuth) {
 +            .toString('utf8')
 -        const userHandles = await getAllUserHandles();
 +            .split(':');
 -        for (const userHandle of userHandles) {
 +        const password = passwordParts.join(':');
 -            if (username === userHandle) {
++
 -                const user = await storage.getItem(toKey(userHandle));
 +        if (!usePerUserAuth && username === basicAuthUserName && password === basicAuthUserPassword) {
 -                if (user && user.enabled && (user.password && user.password === getPasswordHash(password, user.salt))) {
 +            await basicAuthLimiter.delete(ip);
                                 return callback();
 +        } else if (usePerUserAuth) {
 +            const userHandles = await getAllUserHandles();
 +            for (const userHandle of userHandles) {
 +                if (username === userHandle) {
 +                    const user = await storage.getItem(toKey(userHandle));
 +                    if (user && user.enabled && (user.password && user.password === getPasswordHash(password, user.salt))) {
 +                        await basicAuthLimiter.delete(ip);
 +                        return callback();
 +                    }
+                }
+            }
+        }
++
 +        await basicAuthLimiter.consume(ip);
 +        return unauthorizedResponse(response);
 +    } catch (error) {
 +        if (error instanceof RateLimiterRes) {
 +            console.error('Basic auth failed: Rate limited from', getIpAddress(request, PREFER_REAL_IP_HEADER), request.method, request.originalUrl);
 +            return retryAfter(response, error).sendStatus(429);
 +        }
 +        console.error('Basic auth error:', error);
 +        return response.sendStatus(500);
+    }
 -    return unauthorizedResponse(response);
 };
 export default basicAuthMiddleware;

src/middleware/whitelist.js+3 -28 Viewed

 import ipMatching from 'ip-matching';
 import isDocker from 'is-docker';
 import { filterValidIpPatterns, getIpFromRequest, getRealOrForwardedIp } from '../express-common.js';
 import { color, getConfigValue, safeReadFileSync } from '../util.js';
 const whitelistPath = path.join(process.cwd(), './whitelist.txt');

 whitelist = filterValidIpPatterns(whitelist, (entry, message) => `${color.red('Warning')}: Ignoring invalid whitelist entry ${color.yellow(entry)} - ${message}`);
 /**
 - * Get the client IP address from the request headers.
 - * @param {import('express').Request} req Express request object
 - * @returns {string|undefined} The client IP address
 - */
 -function getForwardedIp(req) {
 -    if (!enableForwardedWhitelist) {
 -        return undefined;
 -    }
+-
 -    // Check if X-Real-IP is available
 -    if (req.headers['x-real-ip']) {
 -        return req.headers['x-real-ip'].toString();
 -    }
+-
 -    // Check for X-Forwarded-For and parse if available
 -    if (req.headers['x-forwarded-for']) {
 -        const ipList = req.headers['x-forwarded-for'].toString().split(',').map(ip => ip.trim());
 -        return ipList[0];
 -    }
+-
 -    // If none of the headers are available, return undefined
 -    return undefined;
 -}
+-
 -/**
  * Resolves the IP addresses of Docker hostnames and adds them to the whitelist.
  * @returns {Promise<void>} Promise that resolves when the Docker hostnames are resolved
  */

     return function (req, res, next) {
         const clientIp = getIpFromRequest(req);
         const forwardedIp = getForwardedIpenableForwardedWhitelist && getRealOrForwardedIp(req);
         const userAgent = req.headers['user-agent'];
         /**

         //clientIp = req.connection.remoteAddress.split(':').pop();
         if (!isIPInWhitelist(whitelist, clientIp)
             || (forwardedIp && !isIPInWhitelist(whitelist, forwardedIp))
         ) {
             // Log the connection attempt with real IP address
             const ipDetails = forwardedIp