Login rate limits doen't work as expected

[0fatal]

Rate limits: code-server rate limits password authentication attempts to two per minute and twelve per hour.

It doesn't work for me. It only works when I try to login in frequently, but soon this restriction disappeared again, no more than 1 minute.

[jsjoeio]

Hmm...a couple thoughts of what could be happening:

• the wording could be confusing you (it confused me) and it is working as expected, but you imagine something is
• it's actually broken

We have tests to ensure this works properly. See here: https://github.com/cdr/code-server/blob/main/test/unit/node/routes/login.test.ts#L6-L37

With the way it's set up, you can login 14 times per hour before hitting the limit. Is that what you expected?

[0fatal]

Thank you for your answer. I know that if you fail to log in many times, there will indeed be a "Login rate limited!", but in view of my test, this restriction will soon disappear. In your e2e test, it seems that you should wait for 1 or 2 minute and test again...just like:

 await codeServerPage.page.click(".submit")
 await codeServerPage.page.waitForLoadState("networkidle")
 expect(await codeServerPage.page.isVisible("text=Login rate limited!"))
 // add new
setTimeout(() => {
    expect(await codeServerPage.page.isVisible("text=Login rate limited!"))
},1000 * 120)

[jsjoeio]

Hmm...I see what you mean. To reiterate in my own words, you're saying our tests cover the 14 attempts in 1 hour, but they don't cover the 2 per minute. Is that right?

In your e2e test, it seems that you should wait for 1 or 2 minute and test again

The only downside is now that adds 1-2 mins to our testing suite 😞 @code-asher any ideas on how we could improve this? meaning

[code-asher]

We would probably need some way of artificially advancing the clock; waiting is likely not something we want to do. Maybe Jest has something that can help us here.

Our intention is to rate limit two per minute plus an additional twelve per hour (to allow for an occasional burst). I am happy to elaborate on the reasoning behind these specific limits for anyone interested but this appears to be working as intended.

[code-asher]

Also maybe we should update that documentation again. It looks like it got changed back from plus to and again at some point. It is really:

two per minute plus an additional twelve per hour

The and makes it sound like twelve MAX per hour which is not the intention. The max over the course of an hour is technically 132 attempts (spread out over minute intervals).

[jsjoeio]

It looks like it got changed back from plus to and again at some point. It is really:

Probably happened by accident when we migrated the docs to the Coder website. I'll fix!