63b6cbc01d
Findings security-review P1/P2 (2026-07-03): - headere de securitate pe toate raspunsurile (nosniff, X-Frame-Options, Referrer-Policy, HSTS doar pe HTTPS) + teste - body-cap global 10MB ca middleware ASGI pur (413 inainte de parserul multipart/JSON; verificarea per-endpoint ramane strat 2) - imagine Docker non-root (uid 10001), port 8010 aliniat, loguri pe volumul /data - fail-fast la boot cu rar_env=prod fara AUTOPASS_REQUIRE_API_KEY sau AUTOPASS_SESSION_SECRET - compose: env-uri critice obligatorii (:?) ca api/worker sa nu diverga tacit; FORWARDED_ALLOW_IPS ca rate-limit-ul sa vada IP-ul real dupa Traefik - signup fara PII in stdout: log_event in loc de print cu email (idem notify degradat) - ratelimit: sterge cheile fara timestamp-uri valide (crestere monotona a memoriei pe IP-uri reale) - backup criptat SQLite (backup online API, gpg AES256) + verificare restore + docs/backup.md Suita completa verde: 1557 passed, 1 skipped (live). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
39 lines
1.4 KiB
Python
39 lines
1.4 KiB
Python
"""Rate-limit in-proces cu fereastra glisanta.
|
|
|
|
Fara dependinta externa. Folosit de POST /signup cu cheia = IP client.
|
|
Configurabil prin AUTOPASS_signup_rate_max / AUTOPASS_signup_rate_window_s (config.py).
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import time
|
|
|
|
# ip/key -> lista de timestamps (time.monotonic) ale cererilor din fereastra activa
|
|
_hits: dict[str, list[float]] = {}
|
|
|
|
|
|
def check_rate_limit(key: str, max_hits: int, window_s: int) -> bool:
|
|
"""Fereastra glisanta: returneaza True daca cererea e permisa, False la depasire.
|
|
|
|
Curata timestamp-urile expirate la fiecare apel (O(n) per cheie, acceptabil
|
|
pentru trafic de signup). Thread-safety: GIL Python protejeaza list ops simple;
|
|
suficient pentru un singur proces uvicorn.
|
|
|
|
Cheile fara timestamp-uri valide sunt sterse din `_hits` (nu doar golite), altfel
|
|
dictionarul creste monoton pe viata procesului odata ce cheia devine IP-uri reale
|
|
de internet (F5). Foloseste `.get` in loc de acces direct pe dict pentru a nu
|
|
reintroduce o cheie doar prin citire.
|
|
"""
|
|
now = time.monotonic()
|
|
cutoff = now - window_s
|
|
filtered = [t for t in _hits.get(key, []) if t > cutoff]
|
|
if len(filtered) >= max_hits:
|
|
if filtered:
|
|
_hits[key] = filtered
|
|
else:
|
|
_hits.pop(key, None)
|
|
return False
|
|
filtered.append(now)
|
|
_hits[key] = filtered
|
|
return True
|