Set login rate limiting before comparing credentials, added log entry for successful login #359

Author: Forceu

internal/logging/Logging.go

@@ -270,6 +270,11 @@ func LogInvalidLogin(username, ip string) {
 	createLogEntry(categoryAuth, fmt.Sprintf("Invalid login for user %s by IP %s", username, ip), false)
 }
 
+// LogValidLogin adds a log entry to indicate that a login was successful. Non-blocking
+func LogValidLogin(username string) {
+	createLogEntry(categoryAuth, fmt.Sprintf("%s logged in sucessfully", username), false)
+}
+
 // LogDownload adds a log entry when a download was requested. Non-Blocking
 func LogDownload(file models.File, r *http.Request, saveIp bool) {
 	if saveIp {

internal/webserver/Webserver.go

@@ -511,15 +511,16 @@ func showLogin(w http.ResponseWriter, r *http.Request) {
 	pw := r.Form.Get("password")
 	failedLogin := false
 	if pw != "" && user != "" {
+		ip := logging.GetIpAddress(r)
+		ratelimiter.WaitOnLogin(ip)
 		retrievedUser, validCredentials := authentication.IsCorrectUsernameAndPassword(user, pw)
 		if validCredentials {
+			logging.LogValidLogin(user)
 			sessionmanager.CreateSession(w, false, 0, retrievedUser.Id)
 			redirect(w, "admin")
 			return
 		}
-		ip := logging.GetIpAddress(r)
 		logging.LogInvalidLogin(user, ip)
-		ratelimiter.WaitOnFailedLogin(ip)
 		failedLogin = true
 	}
 	err = templateFolder.ExecuteTemplate(w, "login", LoginView{

internal/webserver/ratelimiter/RateLimiter.go

@@ -31,10 +31,10 @@ func newLimiter() *store {
 	}
 }
 
-// WaitOnFailedLogin blocks the current goroutine until the rate limiter allows a request
-// Two failed attempts without limiting, thereafter one attempt every 3 seconds
-func WaitOnFailedLogin(ip string) {
-	_ = failedLoginLimiter.Get(ip, 1, 6).WaitN(context.Background(), 3)
+// WaitOnLogin blocks the current goroutine until the rate limiter allows a request
+// Three attempts without limiting, thereafter one attempt every 3 seconds
+func WaitOnLogin(ip string) {
+	_ = failedLoginLimiter.Get(ip, 1, 9).WaitN(context.Background(), 3)
 }
 
 // WaitOnFailedId blocks the current goroutine until the rate limiter allows a request