New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added brute-force protection #410

Merged

KizerovDmitriy merged 15 commits into dev from brute-force-authentication

Oct 14, 2024

Contributor

KizerovDmitriy commented Oct 8, 2024 •

edited

Loading

GreenCityUser PR

Added brute-force protection to application.

Integrated a new service to track and block accounts when a user enters incorrect credentials beyond the allowed number of attempts. This service helps to prevent brute-force attacks by monitoring and limiting login attempts.
Implemented CAPTCHA validation to detect bots and prevent automated login attempts. If the CAPTCHA is invalid after a set number of tries, the account is blocked.
Created an email template that will be sent to the user when their account is blocked, providing instructions on how to reset their password and unlock their account.
Added unit tests to cover the brute-force protection functionality, including tracking, blocking, and unblocking logic.
Introduced new environment variables to configure the maximum number of allowed attempts (maxAttempts) and the block duration (blockTime), allowing dynamic adjustment of security settings.
Modified the signIn method to incorporate the new logic for checking account statuses and updating login attempts.

Issue Link 📋

PR Checklist Forms

(to be filled out by PR submitter)

Code is up-to-date with the dev branch.
You've successfully built and run the tests locally.
There are new or updated unit tests validating the change.
JIRA/ Github Issue number & title in PR title (ISSUE-XXXX: Ticket title)
This template filled (above this section).
Sonar's report does not contain bugs, vulnerabilities, security issues, code smells ar duplication
NEED_REVIEW and READY_FOR_REVIEW labels are added.
All files reviewed before sending to reviewers


          implemented brute-force protection

626275b

KizerovDmitriy self-assigned this

IliaWithHat approved these changes

View reviewed changes

lukovskyj approved these changes

View reviewed changes

RomaMocherniuk reviewed

View reviewed changes

core/src/main/java/greencity/security/listener/AuthenticationFailureListener.java Outdated Show resolved Hide resolved

RomaMocherniuk reviewed

View reviewed changes

core/src/main/java/greencity/security/listener/AuthenticationFailureListener.java Outdated Show resolved Hide resolved

RomaMocherniuk reviewed

View reviewed changes

core/src/main/java/greencity/security/listener/AuthenticationFailureListener.java Outdated Show resolved Hide resolved

RomaMocherniuk reviewed

View reviewed changes

core/src/main/java/greencity/security/listener/AuthenticationFailureListener.java Outdated Show resolved Hide resolved

RomaMocherniuk reviewed

View reviewed changes

service-api/pom.xml Show resolved Hide resolved

RomaMocherniuk reviewed

View reviewed changes

service-api/src/main/java/greencity/constant/ErrorMessage.java Outdated Show resolved Hide resolved

RomaMocherniuk reviewed

View reviewed changes

service/src/main/java/greencity/security/service/LoginAttemptServiceImpl.java Outdated Show resolved Hide resolved

RomaMocherniuk reviewed

View reviewed changes

service/src/main/java/greencity/security/service/LoginAttemptServiceImpl.java Outdated Show resolved Hide resolved

RomaMocherniuk reviewed

View reviewed changes

service/src/main/java/greencity/security/service/LoginAttemptServiceImpl.java Outdated Show resolved Hide resolved

RomaMocherniuk reviewed

View reviewed changes

service/src/main/java/greencity/security/service/OwnSecurityServiceImpl.java Outdated Show resolved Hide resolved

RomaMocherniuk commented Oct 8, 2024

Please increase code coverage

KizerovDmitriy added 2 commits

October 9, 2024 13:13


          made changes based on comments to PR

856ff51


          resolved sonar issue

2f70f47

RomaMocherniuk reviewed

View reviewed changes

service-api/src/main/java/greencity/constant/ErrorMessage.java Outdated Show resolved Hide resolved

RomaMocherniuk reviewed

View reviewed changes

service/src/main/java/greencity/security/service/LoginAttemptServiceImpl.java Outdated Show resolved Hide resolved

RomaMocherniuk reviewed

View reviewed changes

service/src/main/java/greencity/security/service/LoginAttemptServiceImpl.java Outdated Show resolved Hide resolved

RomaMocherniuk approved these changes

View reviewed changes

RomaMocherniuk left a comment

Left some minor comments

KizerovDmitriy and others added 9 commits

October 12, 2024 11:49


          refactored all logic in LoginAttemptService

34f635d

added captcha validation
added email message
added template for email message
refactored tests


          Merge branch 'dev' into brute-force-authentication


          fixed security hotspot

3219b0e

added test for OwnSecurityController


          Merge remote-tracking branch 'origin/brute-force-authentication' into…

252763f

… brute-force-authentication


          excluded coverage for cloudflare request and response

1f648cd

added test for EmailService


          added tests for LoginAttemptService

7419bcf


          added tests for OwnSecurityService

cd42f98

resolved sonar issues


          resolved sonar issues

3b68c4b


          change email template

b007008


          changed unblock account link

9a0c34f

refactored unlockAccount endpoint
refactored tests
refactored logic in OwnSecurityService

RomaMocherniuk reviewed

View reviewed changes

core/pom.xml Outdated Show resolved Hide resolved

RomaMocherniuk reviewed

View reviewed changes

core/src/main/resources/messages_en.properties Show resolved Hide resolved

RomaMocherniuk reviewed

View reviewed changes

core/src/main/resources/messages_uk.properties Show resolved Hide resolved

RomaMocherniuk reviewed

View reviewed changes

service-api/pom.xml Outdated Show resolved Hide resolved

KizerovDmitriy added 2 commits

October 14, 2024 12:35


          resolved PR comments

94547ec

refactor logic to generate token
added captcha to management login page


          added test for jwtTools

c7575b4

sonarcloud bot commented Oct 14, 2024

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
95.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

KizerovDmitriy requested a review from RomaMocherniuk

October 14, 2024 09:52

K4sik approved these changes

View reviewed changes

holotsvan approved these changes

View reviewed changes

urio999 approved these changes

View reviewed changes

KizerovDmitriy merged commit 669f26c into dev

3 checks passed

KizerovDmitriy deleted the brute-force-authentication branch

October 14, 2024 10:12

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

IliaWithHat IliaWithHat approved these changes

holotsvan holotsvan approved these changes

urio999 urio999 approved these changes

lukovskyj lukovskyj approved these changes

K4sik K4sik approved these changes

RomaMocherniuk Awaiting requested review from RomaMocherniuk

Labels

None yet