akvo / akvo-mis / #1453

91%

push

coveralls-python

[#525] Add the design for sign-up and auth abuse hardening (#527)

* [#525] Add the design for sign-up and auth abuse hardening

The four public, unauthenticated auth endpoints -- `register`,
`register/resend-activation`, `login` and `user/forgot-password` --
carry no rate limit of any kind, and `register` has no server-side host
gate at all. This records the design for closing both, plus a Cloudflare
Turnstile check wired into sign-up and shipped switched off.

No code yet. Pre-launch hardening with no observed abuse, so the
document argues from exposure.

Four trade-offs in it are worth reading before the implementation, each
because the obvious choice is the wrong one.

`NUM_PROXIES` defaults to 0 rather than to the deployed value of 2. DRF
clamps its index into `X-Forwarded-For` with `min(NUM_PROXIES,
len(addrs))`, so on a deployment with no proxy in front, a non-zero
default resolves a one-entry header to the entry the *client* sent --
handing a bot a fresh rate-limit bucket per request, which is the thing
the limit exists to deny. Leaving the setting unset is no better, since
DRF then keys on the whole header. The 2 belongs in the manifests,
where the proxy chain it describes actually is.

Three endpoints share one pair of throttle scopes instead of having
three. They are not the same flow, but each sends mail through our own
SMTP credentials, which is the exposure being closed. The named cost:
somebody who registers and then resends activation twice has spent
their budget and cannot request a password reset for the rest of the
hour.

Turnstile verification fails open when Cloudflare cannot be reached.
Pre-launch, an outage there closing the sign-up form entirely is worse
than some hours of unguarded registration. That is a judgement about
today rather than a property of the design, so the document says where
to invert it.

`SIGNUP_ENABLED` defaults to `bool(BASE_DOMAIN)`, which means
single-host deployments -- `mohhs-mis`, `unicef-fsm` -- lose
... (continued)

8799 of 9932 branches covered (88.59%)

Branch coverage included in aggregate %.

15982 of 17376 relevant lines covered (91.98%)

0.92 hits per line