Fix max length requirements for the throttler metadata #10670
Conversation
If a failed login is logged, we save the username as metadata in the bruteforce throttler. To prevent database error due to very long strings, this truncates the username at 64 bytes in the assumption that no real username is longer than that.long strings, Signed-off-by: Christoph Wurst <[email protected]>
There was a problem hiding this comment.
strictly speaking, login names (which is what is passed in thereto) can be longer than usernames. For the local backend, it is also possible to login via email, which could be longer than the restriction on the username. And other backends could have other restrictions. In practice, this size should be safe. Alternatively, we can max out the 255 bytes the meta data col can take, just need to consider the json overhead (although this spot wouldn't be the exactly right one). It's likely good enough.
|
Or we should switch the metadata table to hold more than 255 chars... |
yes, however that would be mostly to please the script kiddies to send us their short novels. |
If a failed login is logged, we save the username as metadata
in the bruteforce throttler. To prevent database error due to
very long strings, this truncates the username at 64 bytes in
the assumption that no real username is longer than that.