From d78aed7a37b6a270aaca6a3322ca54d2f02a65ed Mon Sep 17 00:00:00 2001 From: Eugen Rochko Date: Thu, 8 Nov 2018 21:35:58 +0100 Subject: [PATCH] Reduce connect timeout limit and limit signature failures by source IP (#9236) * Reduce connect timeout from 10s to 1s * Limit failing signature verifications per source IP --- app/controllers/concerns/signature_verification.rb | 7 ++++++- app/lib/request.rb | 2 +- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/app/controllers/concerns/signature_verification.rb b/app/controllers/concerns/signature_verification.rb index e5d5e2ca61..7e491641b3 100644 --- a/app/controllers/concerns/signature_verification.rb +++ b/app/controllers/concerns/signature_verification.rb @@ -43,7 +43,12 @@ module SignatureVerification return end - account = account_from_key_id(signature_params['keyId']) + account_stoplight = Stoplight("source:#{request.ip}") { account_from_key_id(signature_params['keyId']) } + .with_fallback { nil } + .with_threshold(1) + .with_cool_off_time(5.minutes.seconds) + + account = account_stoplight.run if account.nil? @signature_verification_failure_reason = "Public key not found for key #{signature_params['keyId']}" diff --git a/app/lib/request.rb b/app/lib/request.rb index 36c211dbfe..73b495ce19 100644 --- a/app/lib/request.rb +++ b/app/lib/request.rb @@ -94,7 +94,7 @@ class Request end def timeout - { write: 10, connect: 10, read: 10 } + { connect: 1, read: 10, write: 10 } end def http_client