case 4681 - rate limits on the anonymous trial and licence routes, stricter email check, cryptographic codes

Anonymous trial requests could be sent without limit, each one emailing a
verification link to any address (bounces from made-up domains), and the
verification and v7 fetch codes came from System.Random (AyaNova security
review F40).
- ASP.NET Core rate limiter per client address: trial requests (rvr,
  subscription-server-trial-request) 5 per hour; verify, rvf and the legacy v7
  fetch 30 per 10 minutes; 429 over the limit. Runs after routing and after
  forwarded headers.
- rvr: the email must be a valid address (MailAddress) before anything is
  stored or sent.
- GenFetchCode: RandomNumberGenerator, same 10-letter format.
rvf is unchanged (still one-shot): repeatable fetch needs an AyaNova-side change
for older servers and is a separate later case.

Checked on the local server with invalid addresses only (no email sent, no
request stored): 6th trial request 429, 31st fetch 429, auth unaffected.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/Controllers/FetchController.cs

@@ -41,6 +41,7 @@ namespace Sockeye.Api.Controllers
         //////////////////////////////////////////////////////////////////////////      
         // GET: fetch/somecode/bob@bob.com
         [HttpGet("{code}/{email}")]
+        [Microsoft.AspNetCore.RateLimiting.EnableRateLimiting(Startup.RATE_LIMIT_LICENSE_FETCH)]//case 4681
         public async Task<IActionResult> Get([FromRoute] string code, [FromRoute] string email)
         {
 

server/Controllers/RvfController.cs

@@ -46,6 +46,7 @@ namespace Sockeye.Api.Controllers
         //### RAVEN FETCH LICENSE REQUEST HERE ####
         //This route is used by Raven to check if there is an unfetched license key and return it
         [HttpPost]
+        [Microsoft.AspNetCore.RateLimiting.EnableRateLimiting(Startup.RATE_LIMIT_LICENSE_FETCH)]//case 4681
         public async Task<IActionResult> PostLicenseFetchRequest([FromBody] dtoFetchRequest fetchRequest)
         {
             if (!serverState.IsOpen)

server/Controllers/RvrController.cs

@@ -60,6 +60,7 @@ namespace Sockeye.Api.Controllers
         //REQUEST TRIAL ROUTE CALLED FROM RAVEN
         //#########################################################
         [HttpPost]
+        [Microsoft.AspNetCore.RateLimiting.EnableRateLimiting(Startup.RATE_LIMIT_TRIAL_REQUESTS)]//case 4681
         public async Task<IActionResult> Post([FromBody] dtoRequest r)
         {
             if (!serverState.IsOpen)
@@ -70,6 +71,12 @@ namespace Sockeye.Api.Controllers
                 return BadRequest(ModelState);
             }
 
+            //case 4681: a verification email is sent to this address, so it must at least be a valid address
+            if (string.IsNullOrWhiteSpace(r.Email) || !System.Net.Mail.MailAddress.TryCreate(r.Email.Trim(), out var parsedEmail) || parsedEmail.Address != r.Email.Trim())
+            {
+                return BadRequest("E1000 - Email address invalid");
+            }
+
             // if (r.DbId == Guid.Empty)
             if (string.IsNullOrWhiteSpace(r.DbId))
             {
@@ -114,6 +121,7 @@ namespace Sockeye.Api.Controllers
 
         //### CUSTOMER ROUTE CALLED FROM CUSTOMER BROWSER / EMAIL ####
         [HttpGet("verify/{code}")]
+        [Microsoft.AspNetCore.RateLimiting.EnableRateLimiting(Startup.RATE_LIMIT_LICENSE_FETCH)]//case 4681
         public async Task<IActionResult> GetVerify([FromRoute] string code)
         {
             if (!serverState.IsOpen)

server/Controllers/SubscriptionServerTrialRequestController.cs

@@ -57,6 +57,7 @@ namespace Sockeye.Api.Controllers
         //REQUEST ROUTE CALLED FROM CONTACT FORMS APP
         //#########################################################
         [HttpPost]
+        [Microsoft.AspNetCore.RateLimiting.EnableRateLimiting(Startup.RATE_LIMIT_TRIAL_REQUESTS)]//case 4681
         public async Task<IActionResult> Post([FromBody] dtoSubscriptionServerTrialRequest r)
         {
             if (!serverState.IsOpen)

server/Startup.cs

@@ -28,6 +28,10 @@ namespace Sockeye
 {
     public class Startup
     {
+        //case 4681: rate limit policy names used on the anonymous trial and licence routes
+        internal const string RATE_LIMIT_TRIAL_REQUESTS = "trial-requests";
+        internal const string RATE_LIMIT_LICENSE_FETCH = "license-fetch";
+
         /////////////////////////////////////////////////////////////
         //
         public Startup(Microsoft.AspNetCore.Hosting.IWebHostEnvironment hostingEnvironment)
@@ -174,6 +178,19 @@ namespace Sockeye
                     );
             });
 
+            //case 4681: per client address limits on the anonymous trial request and licence fetch routes
+            _newLog.LogDebug("Rate limiting");
+            services.AddRateLimiter(options =>
+            {
+                options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
+                options.AddPolicy(RATE_LIMIT_TRIAL_REQUESTS, context => System.Threading.RateLimiting.RateLimitPartition.GetFixedWindowLimiter(
+                    context.Connection.RemoteIpAddress?.ToString() ?? "unknown",
+                    _ => new System.Threading.RateLimiting.FixedWindowRateLimiterOptions { PermitLimit = 5, Window = TimeSpan.FromHours(1), QueueLimit = 0 }));
+                options.AddPolicy(RATE_LIMIT_LICENSE_FETCH, context => System.Threading.RateLimiting.RateLimitPartition.GetFixedWindowLimiter(
+                    context.Connection.RemoteIpAddress?.ToString() ?? "unknown",
+                    _ => new System.Threading.RateLimiting.FixedWindowRateLimiterOptions { PermitLimit = 30, Window = TimeSpan.FromMinutes(10), QueueLimit = 0 }));
+            });
+
 
 
 
@@ -375,7 +392,10 @@ namespace Sockeye
             #endregion
 
             _newLog.LogDebug("Routing pipeline");
-            app.UseRouting();//this wasn't here for 2.2 but added for 3.0, needs to come before the stuff after 
+            app.UseRouting();//this wasn't here for 2.2 but added for 3.0, needs to come before the stuff after
+
+            //case 4681: after routing so the per-route policies apply (and after forwarded headers so the client address is the real one)
+            app.UseRateLimiter();
 
             _newLog.LogDebug("CORS pipeline");
             app.UseCors("CorsPolicy");

server/util/StringUtil.cs

@@ -178,11 +178,11 @@ namespace Sockeye.Util
 
             var chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
             var stringChars = new char[10];
-            var random = new Random();
 
+            //case 4681: cryptographic random, same format as before
             for (int i = 0; i < stringChars.Length; i++)
             {
-                stringChars[i] = chars[random.Next(chars.Length)];
+                stringChars[i] = chars[System.Security.Cryptography.RandomNumberGenerator.GetInt32(chars.Length)];
             }
 
             var finalString = new String(stringChars);