mirror of
https://github.com/HolgerHatGarKeineNode/einundzwanzig-nostr.git
synced 2026-02-15 03:23:17 +00:00
9faae15212
## Security Audit: Fehlendes Rate Limiting
### Problem
Die Anwendung hat **kein Rate Limiting** auf API-Routes oder Livewire-Actions. Das ermöglicht:
- Brute-Force-Angriffe auf Authentication-Endpoints
- Denial-of-Service durch massenhaftes Aufrufen von API-Endpoints
- Vote-Manipulation durch schnelle, wiederholte Requests
- Ressourcen-Erschöpfung durch unkontrollierte Datenbankabfragen
### Betroffene Endpoints
**API-Routes (`routes/api.php`):**
```php
Route::get('/nostr/profile/{key}', GetProfile::class); // kein Rate Limit
Route::get('/members/{year}', GetPaidMembers::class); // kein Rate Limit
```
**Kritische Livewire-Actions (kein Throttling):**
- Voting auf ProjectProposals (`association/project-support/show`)
- Login via Nostr (`handleNostrLogin`)
- ProjectProposal-Erstellung
- Election Voting
### Lösung
**1. API Rate Limiting in `bootstrap/app.php`:**
Nutze Laravel 12's Middleware-Konfiguration um Rate Limiting zu aktivieren:
```php
->withMiddleware(function (Middleware $middleware) {
$middleware->api(prepend: [
\Illuminate\Routing\Middleware\ThrottleRequests::class.':api',
]);
})
```
Und definiere den `api` Rate Limiter in `app/Providers/AppServiceProvider.php`:
```php
use Illuminate\Cache\RateLimiting\Limit;
use Illuminate\Support\Facades\RateLimiter;
public function boot(): void
{
RateLimiter::for('api', function (Request $request) {
return Limit::perMinute(60)->by($request->ip());
});
}
```
**2. Livewire Action Throttling:**
Nutze Livewire's `#[Throttle]` Attribut auf sensiblen Actions. Suche in der Livewire-Dokumentation nach der korrekten v4-Syntax mit `search-docs`:
- `queries: ['throttle', 'rate limiting']`
- `packages: ['livewire/livewire']`
Wende Throttling an auf:
- Vote-Submit-Methoden in den ProjectSupport-Components
- Login-Handler (`handleNostrLogin` in `WithNostrAuth` Trait)
- ProjectProposal Create/Update Actions
**3. Zusätzlicher Custom Rate Limiter für Voting:**
```php
RateLimiter::for('voting', function (Request $request) {
return Limit::perMinute(10)->by($request->ip());
});
```
### Betroffene Dateien
- `bootstrap/app.php` – Middleware-Konfiguration (Rate Limit Middleware hinzufügen)
- `app/Providers/AppServiceProvider.php` – RateLimiter Definitionen
- `routes/api.php` – Rate Limit Middleware anwenden
- `app/Livewire/Traits/WithNostrAuth.php` – Throttle auf `handleNostrLogin`
- Livewire-Components in `app/Livewire/Association/ProjectSupport/` – Throttle auf Vote/Create Actions
### Vorgehen
1. `search-docs` nutzen für: `['rate limiting', 'throttle']` (Laravel) und `['throttle']` (Livewire)
2. Rate Limiter in AppServiceProvider definieren
3. API-Middleware in `bootstrap/app.php` konfigurieren
4. Livewire-Actions mit Throttle versehen
5. Pest-Tests schreiben, die verifizieren dass Rate Limiting greift (429 Response bei Überschreitung)
6. `vendor/bin/pint --dirty` und `php artisan test --compact`
### Akzeptanzkriterien
- API-Routes geben HTTP 429 nach 60 Requests/Minute zurück
- Voting-Actions sind auf max. 10/Minute limitiert
- Login-Attempts sind throttled
- Tests verifizieren Rate Limiting Verhalten
70 lines
1.7 KiB
PHP
70 lines
1.7 KiB
PHP
<?php
|
|
|
|
namespace App\Livewire\Traits;
|
|
|
|
use App\Support\NostrAuth;
|
|
use Illuminate\Support\Facades\RateLimiter;
|
|
use Livewire\Attributes\On;
|
|
|
|
trait WithNostrAuth
|
|
{
|
|
public ?string $currentPubkey = null;
|
|
|
|
public ?object $currentPleb = null;
|
|
|
|
public bool $isAllowed = false;
|
|
|
|
public bool $canEdit = false;
|
|
|
|
#[On('nostrLoggedIn')]
|
|
public function handleNostrLogin(string $pubkey): void
|
|
{
|
|
$executed = RateLimiter::attempt(
|
|
'nostr-login:'.request()->ip(),
|
|
10,
|
|
function () {},
|
|
);
|
|
|
|
if (! $executed) {
|
|
abort(429, 'Too many login attempts.');
|
|
}
|
|
|
|
NostrAuth::login($pubkey);
|
|
|
|
$this->currentPubkey = $pubkey;
|
|
$this->currentPleb = \App\Models\EinundzwanzigPleb::query()
|
|
->where('pubkey', $pubkey)
|
|
->first();
|
|
|
|
if ($this->currentPleb && in_array($this->currentPleb->npub, config('einundzwanzig.config.current_board'), true)) {
|
|
$this->canEdit = true;
|
|
}
|
|
|
|
$this->isAllowed = true;
|
|
}
|
|
|
|
#[On('nostrLoggedOut')]
|
|
public function handleNostrLogout(): void
|
|
{
|
|
NostrAuth::logout();
|
|
|
|
$this->isAllowed = false;
|
|
$this->currentPubkey = null;
|
|
$this->currentPleb = null;
|
|
$this->canEdit = false;
|
|
}
|
|
|
|
public function mountWithNostrAuth(): void
|
|
{
|
|
if ($user = NostrAuth::user()) {
|
|
$this->currentPubkey = $user->getPubkey();
|
|
$this->currentPleb = $user->getPleb();
|
|
$this->isAllowed = true;
|
|
|
|
if ($this->currentPleb && in_array($this->currentPleb->npub, config('einundzwanzig.config.current_board'), true)) {
|
|
$this->canEdit = true;
|
|
}
|
|
}
|
|
}
|
|
}
|