yetangitu/funkwhale
1
0
Fork 0
mirror of https://code.eliotberriot.com/funkwhale/funkwhale.git synced 2025-10-05 00:49:16 +02:00
Code Issues Releases Wiki Activity

See #261: Added a rate-limiting (throttling system) to limit the number of requests handled per user/IP

Browse source
This commit is contained in:
Eliot Berriot 2019-09-17 11:23:59 +02:00
parent 8666afc64f
commit d28bf65d00
20 changed files with 1077 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

20
api/funkwhale_api/users/oauth/views.py
View file

@ -10,6 +10,8 @@ from oauth2_provider import exceptions as oauth2_exceptions
from oauth2_provider import views as oauth_views
from oauth2_provider.settings import oauth2_settings
from funkwhale_api.common import throttling
from .. import models
from .permissions import ScopePermission
from . import serializers
@ -35,6 +37,12 @@ class ApplicationViewSet(
lookup_field = "client_id"
queryset = models.Application.objects.all().order_by("-created")
serializer_class = serializers.ApplicationSerializer
throttling_scopes = {
"create": {
"anonymous": "anonymous-oauth-app",
"authenticated": "authenticated-oauth-app",
}
}
def get_serializer_class(self):
if self.request.method.lower() == "post":
@ -141,6 +149,10 @@ class AuthorizeView(views.APIView, oauth_views.AuthorizationView):
return self.json_payload(errors, status_code=400)
def post(self, request, *args, **kwargs):
throttling.check_request(request, "oauth-authorize")
return super().post(request, *args, **kwargs)
def form_valid(self, form):
try:
response = super().form_valid(form)
@ -175,8 +187,12 @@ class AuthorizeView(views.APIView, oauth_views.AuthorizationView):
class TokenView(oauth_views.TokenView):
pass
def post(self, request, *args, **kwargs):
throttling.check_request(request, "oauth-token")
return super().post(request, *args, **kwargs)
class RevokeTokenView(oauth_views.RevokeTokenView):
pass
def post(self, request, *args, **kwargs):
throttling.check_request(request, "oauth-revoke-token")
return super().post(request, *args, **kwargs)