gws.base.auth.throttle

Authentication throttle.

Source code: gws.base.auth.throttle

Module Contents

class gws.base.auth.throttle.Config(*args, **kwargs)

Bases: gws.Config

Blocking of repeated failed authentication attempts.

allowFrom: list[str] | None

IP addresses exempt from throttling.

blockTime: gws.Duration = '15m'

How long to block once the limit is reached.

maxAttemptsPerIp: int = 10

Failed attempts from one address before blocking.

maxAttemptsPerUser: int = 0

Failed attempts per login name from any address before blocking, 0 for no limit.

path: str | None

File that stores failed attempts.

windowTime: gws.Duration = '10m'

Time span in which failed attempts are counted.

class gws.base.auth.throttle.Object

Bases: gws.Node

Authentication throttle.

Counts failed authentication attempts per remote address and, optionally, per login name, and blocks further attempts once a limit is reached.

allowFrom: set[str]

IP addresses exempt from throttling.

blockTime: int

Blocking time in seconds.

dbPath: str

Path to the sqlite database.

maxAttemptsPerIp: int

Failed attempts from one address before blocking, 0 for no limit.

maxAttemptsPerUser: int

Failed attempts per login name before blocking, 0 for no limit.

table = 'throttle'

Name of the database table.

windowTime: int

Time span in seconds in which failed attempts are counted.

blocked_for(req: gws.WebRequester, method: gws.AuthMethod, credentials: gws.Data) → int

Return how long an authentication attempt remains blocked.

Parameters:

• req – The web request, provides the remote address.

• method – The authentication method.

• credentials – The credentials, provide the login name as username.

Returns:

The remaining blocking time in seconds, 0 if the attempt is allowed.

cleanup()

Remove the counts whose window has elapsed and which hold no active block.

configure()

Configuration hook.

Called when the node is initialized. Raising an exception here aborts the creation of the node.

register(ok: bool, req: gws.WebRequester, method: gws.AuthMethod, credentials: gws.Data)

Register the outcome of an authentication attempt.

A success removes the counts for the address and the login name. A failure increments them and starts a block once a limit is reached.

Parameters:

• ok – Whether the attempt was successful.

• req – The web request, provides the remote address.

• method – The authentication method.

• credentials – The credentials, provide the login name as username.