You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@syncope.apache.org by "massx1 (via GitHub)" <gi...@apache.org> on 2026/06/09 14:41:02 UTC
[PR] [SYNCOPE-1975] - Throttle password reset requests [syncope]
massx1 opened a new pull request, #1419:
URL: https://github.com/apache/syncope/pull/1419
This change adds configurable throttling for anonymous password reset requests.
The throttling is applied before user lookup, so repeated requests for both existing and non-existing usernames are handled consistently.
When the configured threshold is exceeded, Syncope returns HTTP 429 Too Many Requests with a Retry-After header.
The feature is controlled by dedicated security properties.
The client address is included in the throttling key to avoid allowing an attacker who knows a username or email address to globally block password reset requests for that account.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@syncope.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [SYNCOPE-1975] - Throttle password reset requests [syncope]
Posted by "github-advanced-security[bot] (via GitHub)" <gi...@apache.org>.
github-advanced-security[bot] commented on code in PR #1419:
URL: https://github.com/apache/syncope/pull/1419#discussion_r3381695037
##########
fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserSelfITCase.java:
##########
@@ -392,6 +396,33 @@
assertNotEquals(pwdOnResource, newPwdOnResource);
}
+ @Test
+ public void passwordResetThrottle() {
+ String username = "missing-" + UUID.randomUUID() + "@syncope.apache.org";
+ UserSelfService userSelfService = ANONYMOUS_CLIENT.getService(UserSelfService.class);
+
+ int maxAttempts;
+ try (InputStream propStream = AbstractITCase.class.getResourceAsStream("/core.properties")) {
+ Properties props = new Properties();
+ props.load(propStream);
+ maxAttempts = Integer.parseInt(props.getProperty("security.passwordReset.throttle.maxAttempts", "5"));
Review Comment:
## CodeQL / Missing catch of NumberFormatException
Potential uncaught 'java.lang.NumberFormatException'.
[Show more details](https://github.com/apache/syncope/security/code-scanning/2642)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@syncope.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [SYNCOPE-1975] Throttle password reset requests [syncope]
Posted by "ilgrosso (via GitHub)" <gi...@apache.org>.
ilgrosso merged PR #1419:
URL: https://github.com/apache/syncope/pull/1419
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@syncope.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [SYNCOPE-1975] Throttle password reset requests [syncope]
Posted by "ilgrosso (via GitHub)" <gi...@apache.org>.
ilgrosso commented on PR #1419:
URL: https://github.com/apache/syncope/pull/1419#issuecomment-4717919528
@massx1 the PR looks ok now, please add some docs and we can merge it
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@syncope.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org