Internal
Public Access
Keith SmithandClaude Sonnet 4.5
deabe6ab3d
Added comprehensive rate limiting to prevent abuse and DoS attacks: Configuration (config/settings/base.py): - Anon rate: 100 requests/hour for anonymous users - User rate: 1000 requests/hour for authenticated users - Login rate: 10 attempts/hour (prevents brute force) - Register rate: 5 attempts/hour (prevents account spam) - Sync rate: 100 requests/hour (prevents sync flooding) Custom throttle classes (users/throttles.py): - LoginRateThrottle: Strict limit for login endpoint - RegisterRateThrottle: Strict limit for registration endpoint - SyncRateThrottle: Moderate limit for sync endpoint Applied throttling to sensitive endpoints: - users.views.RegisterAPIView: 5/hour - users.views.TokenObtainPairView: 10/hour - sync.views.sync: 100/hour All other API endpoints use default throttles (anon: 100/hour, user: 1000/hour). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
33 lines
688 B
Python
33 lines
688 B
Python
"""
|
|
Custom throttle classes for user-related endpoints.
|
|
"""
|
|
|
|
from rest_framework.throttling import AnonRateThrottle, UserRateThrottle
|
|
|
|
|
|
class LoginRateThrottle(AnonRateThrottle):
|
|
"""
|
|
Rate limit for login attempts.
|
|
|
|
Stricter than general anonymous rate to prevent brute force attacks.
|
|
"""
|
|
scope = 'login'
|
|
|
|
|
|
class RegisterRateThrottle(AnonRateThrottle):
|
|
"""
|
|
Rate limit for registration attempts.
|
|
|
|
Prevents automated account creation and abuse.
|
|
"""
|
|
scope = 'register'
|
|
|
|
|
|
class SyncRateThrottle(UserRateThrottle):
|
|
"""
|
|
Rate limit for sync endpoint.
|
|
|
|
Prevents excessive sync requests that could overload the server.
|
|
"""
|
|
scope = 'sync'
|