John Cardinal
cd3ebed68b
Anonymous trial requests could be sent without limit, each one emailing a verification link to any address (bounces from made-up domains), and the verification and v7 fetch codes came from System.Random (AyaNova security review F40). - ASP.NET Core rate limiter per client address: trial requests (rvr, subscription-server-trial-request) 5 per hour; verify, rvf and the legacy v7 fetch 30 per 10 minutes; 429 over the limit. Runs after routing and after forwarded headers. - rvr: the email must be a valid address (MailAddress) before anything is stored or sent. - GenFetchCode: RandomNumberGenerator, same 10-letter format. rvf is unchanged (still one-shot): repeatable fetch needs an AyaNova-side change for older servers and is a separate later case. Checked on the local server with invalid addresses only (no email sent, no request stored): 6th trial request 429, 31st fetch 429, auth unaffected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
76 lines
2.7 KiB
C#
76 lines
2.7 KiB
C#
using System.Threading.Tasks;
|
|
using Microsoft.AspNetCore.Mvc;
|
|
using Microsoft.AspNetCore.Routing;
|
|
using Microsoft.Extensions.Logging;
|
|
using Microsoft.EntityFrameworkCore;
|
|
using Sockeye.Models;
|
|
using Sockeye.Api.ControllerHelpers;
|
|
|
|
|
|
namespace Sockeye.Api.Controllers
|
|
{
|
|
|
|
[Route("fetch")]//Legacy v7 license fetch route
|
|
[Produces("text/plain")]
|
|
#pragma warning disable AV0014 // Missing API behavior
|
|
public class FetchController : ControllerBase
|
|
#pragma warning restore AV0014 // Missing API behavior
|
|
{
|
|
|
|
private readonly AyContext ct;
|
|
private readonly ILogger<FetchController> log;
|
|
private readonly ApiServerState serverState;
|
|
|
|
/// <summary>
|
|
/// ctor
|
|
/// </summary>
|
|
/// <param name="dbcontext"></param>
|
|
/// <param name="logger"></param>
|
|
/// <param name="apiServerState"></param>
|
|
public FetchController(AyContext dbcontext, ILogger<FetchController> logger, ApiServerState apiServerState)
|
|
{
|
|
ct = dbcontext;
|
|
log = logger;
|
|
serverState = apiServerState;
|
|
}
|
|
|
|
|
|
//////////////////////////////////////////////////////////////////////////
|
|
//########### AyaNova 7.x License fetch route ############
|
|
//For legacy reasons route needs to be named /fetch
|
|
//////////////////////////////////////////////////////////////////////////
|
|
// GET: fetch/somecode/bob@bob.com
|
|
[HttpGet("{code}/{email}")]
|
|
[Microsoft.AspNetCore.RateLimiting.EnableRateLimiting(Startup.RATE_LIMIT_LICENSE_FETCH)]//case 4681
|
|
public async Task<IActionResult> Get([FromRoute] string code, [FromRoute] string email)
|
|
{
|
|
|
|
if (!serverState.IsOpen)
|
|
return StatusCode(503, new ApiErrorResponse(serverState.ApiErrorCode, null, serverState.Reason));
|
|
|
|
if (!ModelState.IsValid)
|
|
{
|
|
return BadRequest(ModelState);
|
|
}
|
|
|
|
var rec = await ct.License.SingleOrDefaultAsync(m => m.FetchCode == code.Trim() && m.FetchEmail == email.Trim().ToLowerInvariant() && m.FetchedOn == null);
|
|
|
|
if (rec == null)
|
|
{
|
|
//delay, could be someone fishing for a key, make it painful
|
|
//Have verified this is safe, won't affect other jobs on server
|
|
//happening concurrently or other requests to server
|
|
System.Threading.Thread.Sleep(10000);
|
|
return NotFound();
|
|
}
|
|
rec.FetchedOn = System.DateTime.UtcNow;
|
|
await ct.SaveChangesAsync();
|
|
return Ok(rec.Key);
|
|
}
|
|
|
|
|
|
//------------
|
|
|
|
|
|
}//eoc
|
|
}//eons |