Struct LoginThrottle 

pub struct LoginThrottle { /* private fields */ }

How many sign-in attempts one login may make from one client address in a window, as Auth::throttle sets it.

Each attempt that reaches the authenticator counts against the login it names, trimmed and lowercased, and the address client_ip answers, from the first attempt of the window; a successful sign-in clears that count. Past the limit, the login page refuses the attempt without asking the authenticator, with the same 403 and message as a wrong password, until the window ends, and logs a warning.

Keying on the address keeps a guesser from locking the account’s owner out from elsewhere. Behind a reverse proxy every request carries the proxy’s address unless the router trusts it through TrustedProxies; until then the count is per login alone, and a guesser can lock the owner out.

Auth::account_throttle adds an opt-in, looser count per login across addresses. The first sign-in that carries X-Forwarded-For or Forwarded and whose client address is still the connection’s logs a warning: either the router trusts no proxy, or the request bypassed the trusted ones.

It does not limit one client across logins, nor a login spelled several ways that the authenticator’s lookup treats as one, as MySQL’s default collation does with accents: a per-IP limit at the proxy covers those. Counts live in the process and per panel, so each replica and each panel counts its own attempts, and a restart clears them; in_database keeps them where every replica reads them.

use std::time::Duration;

use tablo_core::{Auth, LoginThrottle};

let auth = Auth::password().throttle(LoginThrottle::new(10, Duration::from_secs(300)));

Implementations

impl LoginThrottle

pub fn new(attempts: u32, window: Duration) -> Self

Allows attempts sign-in attempts per login in each window.

Panics

When attempts is 0 or window is zero: neither allows a sign-in.

pub fn off() -> Self

Counts nothing, for a deployment whose proxy limits sign-ins.

pub fn in_database(self) -> Self

Keeps the counts in the database, as AuthThrottle rows, rather than in the process: every replica then counts against the same limit, and a restart forgets nothing. Each attempt costs a serializable transaction, and mounting requires the model, which models! registers.

use std::time::Duration;

use tablo_core::{Auth, LoginThrottle};

let auth =
    Auth::password().throttle(LoginThrottle::new(10, Duration::from_secs(300)).in_database());

Trait Implementations

impl Debug for LoginThrottle

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for LoginThrottle

Five attempts per login and address a minute.

fn default() -> Self

Returns the “default value” for a type.