Add rate limiting to login, register, forgot-password and TOTP

Author: Thiritin

app/Http/Controllers/TwoFactorController.php

@@ -59,7 +59,7 @@ public function submit(Request $request)
                 throw ValidationException::withMessages(['code' => 'Invalid Yubikey code.']);
             }
         } elseif ($data['method'] === 'totp') {
-            if (! $this->verifyTOTP($data, $twoFactors)) {
+            if (! $this->verifyTOTP($data, $twoFactors, $user)) {
                 throw ValidationException::withMessages(['code' => 'Invalid TOTP code.']);
             }
         } else {
@@ -96,12 +96,18 @@ public function verifyYubikey($data, Collection $twoFactors, $user): bool
         return $success;
     }
 
-    public function verifyTOTP($data, Collection $twoFactors): bool
+    public function verifyTOTP($data, Collection $twoFactors, $user): bool
     {
+        $limitKey = 'totp-verify-' . $user->id;
+        if (RateLimiter::tooManyAttempts($limitKey, 10)) {
+            throw ValidationException::withMessages(['code' => 'Too many attempts. Please try again later.']);
+        }
+        RateLimiter::hit($limitKey, 120);
+
         $factorModel = $twoFactors->first();
         $success = (new TwoFactorAuth())->verifyCode($factorModel->secret, $data['code']);
         if ($success) {
-            // Update last used at
+            RateLimiter::clear($limitKey);
             $factorModel->update(['last_used_at' => now()]);
         }
 

routes/web.php

@@ -18,7 +18,7 @@
         'login.view'
     );
     Route::post('login', [LoginController::class, 'submit'])
-        ->middleware([HandlePrecognitiveRequests::class])
+        ->middleware([HandlePrecognitiveRequests::class, 'throttle:5,1'])
         ->name('login.submit');
 
     Route::get('two-factor',
@@ -39,12 +39,12 @@
         // Register
         Route::inertia('register', 'Auth/Register')->name('register.view');
         Route::post('register', RegisterController::class)
-            ->middleware(['guest', HandlePrecognitiveRequests::class])
+            ->middleware(['guest', HandlePrecognitiveRequests::class, 'throttle:5,1'])
             ->name('register.store');
         // Password Reset
         Route::inertia('forgot-password', 'Auth/ForgotPassword')->name('forgot-password.view');
         Route::post('forgot-password', ForgotPasswordController::class)
-            ->middleware([HandlePrecognitiveRequests::class])
+            ->middleware([HandlePrecognitiveRequests::class, 'throttle:5,1'])
             ->name('forgot-password.store');
         // Set new Password
         Route::get('password-reset', [PasswordResetController::class, 'view'])->name('password-reset.view');