supabase / auth / 14384966916

69%

Build Type

push

github

Committed by web-flow

Commit Message

feat: separate web3 rate limits from other `/token?grant_type=...` (#1985)

Sign in with Web3 can be very prone to abuse. This is because all it
takes for the `/token?grant_type=web3` endpoint to be abused is the
generation of signed messages by a private key.

For this reason a new rate limit config is provided
`GOTRUE_RATE_LIMIT_WEB3` which limits the number of such calls per IP
address.

To achieve this, the rate limit enforcement on the `/token` API is moved
inside in the `Token` handler. This provides a future basis for
separating out the rate limiters for Sign in with Password and ID token,
as well as rate limiters for PKCE.

Run Details

39 of 50 new or added lines in 5 files covered. (78.0%)

3 existing lines in 2 files now uncovered.

10532 of 15468 relevant lines covered (68.09%)

65.14 hits per line