pmb
3115ac64b2
The app sits behind nginx, which caches 200s for 30s — so repeated lookups of the same user are cheap. What bypasses the cache is enumeration of distinct usernames: each is a unique cache key -> miss -> a fresh finger call to the mammut daemon, all attributed to admin's single IP (so the daemon cannot ban the real source). The app only ever receives cache misses, so a per-IP limit here throttles exactly that uncached path without touching the cached hot path. - Flask-Limiter keyed per client IP: 30/min on the finger lookup endpoints, 10/min on /api/upload (auth brute-force), 120/min global default. Index and the container healthcheck are exempt. All limits env-tunable (RATELIMIT_*). - ProxyFix(x_for=1): trust nginx's X-Forwarded-For so the real client IP is used for keying and logging. Without it the app only saw the Docker bridge gateway (172.20.0.1) and every client shared one bucket. - 429 handler (JSON for /api, HTML 429.html otherwise) and WARNING logging of failed/invalid lookups and limit hits, so enumeration is observable.
27 lines
982 B
HTML
27 lines
982 B
HTML
{% extends "base.html" %}
|
|
|
|
{% block content %}
|
|
<div class="row">
|
|
<div class="col-lg-6 mx-auto text-center">
|
|
<div class="card">
|
|
<div class="card-body">
|
|
<h1 class="display-1 text-muted">429</h1>
|
|
<h2 class="mb-3">Too Many Requests</h2>
|
|
<p class="lead">
|
|
You've sent too many requests in a short period. Please slow
|
|
down and try again in a moment.
|
|
</p>
|
|
{% if detail %}
|
|
<p class="text-muted"><small>Limit: {{ detail }}</small></p>
|
|
{% endif %}
|
|
<hr class="my-4">
|
|
<div class="d-grid gap-2 d-md-block">
|
|
<a href="{{ url_for('index') }}" class="btn btn-primary">Go Home</a>
|
|
<a href="javascript:history.back()" class="btn btn-outline-secondary">Go Back</a>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
{% endblock %}
|