Skip to content

Commit 2128962

Browse files
author
ID Bot
committed
Script updating gh-pages from 2e8e0a4. [ci skip]
1 parent 3528cfd commit 2128962

File tree

2 files changed

+7
-7
lines changed

2 files changed

+7
-7
lines changed

PieterKas-patch-873896/draft-ietf-oauth-cross-device-security.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2614,7 +2614,7 @@ <h4 id="name-short-lived-tokens">
26142614
<h4 id="name-rate-limits">
26152615
<a href="#section-6.1.11" class="section-number selfRef">6.1.11. </a><a href="#name-rate-limits" class="section-name selfRef">Rate Limits</a>
26162616
</h4>
2617-
<p id="section-6.1.11-1">An attacker that engages in a scaled attack may need to request a large number of user codes (see exploit <a href="#example-b1" class="auto internal xref">Section 4.3.1</a>) or initiate a large number of authorization requests (see exploit <a href="#example-b4-1" class="auto internal xref">Section 4.3.4.1</a> and <a href="#example-b9" class="auto internal xref">Section 4.3.9</a>) in a short period of time. An authorization server MAY apply rate limits to minimize the number of requests it would accept from a client or send to a user in a limited time period.<a href="#section-6.1.11-1" class="pilcrow"></a></p>
2617+
<p id="section-6.1.11-1">An attacker that engages in a scaled attack may need to request a large number of user codes (see exploit described in <a href="#example-b1" class="auto internal xref">Section 4.3.1</a>) or initiate a large number of authorization requests (see exploits described in <a href="#example-b4-1" class="auto internal xref">Section 4.3.4.1</a> and <a href="#example-b9" class="auto internal xref">Section 4.3.9</a>) in a short period of time. An authorization server MAY apply rate limits to minimize the number of requests it would accept from a client or send to a user in a limited time period.<a href="#section-6.1.11-1" class="pilcrow"></a></p>
26182618
<p id="section-6.1.11-2"><strong>Limitations:</strong> Rate limits are effective at slowing an attacker down and help to degrade scaled attacks, but do not prevent more targeted attacks that are executed with lower volumes and velocity. Therefore, it should be used along with other techniques to provide a defence-in-depth defence against cross-device attacks.<a href="#section-6.1.11-2" class="pilcrow"></a></p>
26192619
</section>
26202620
</div>

PieterKas-patch-873896/draft-ietf-oauth-cross-device-security.txt

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1942,12 +1942,12 @@ Table of Contents
19421942
6.1.11. Rate Limits
19431943

19441944
An attacker that engages in a scaled attack may need to request a
1945-
large number of user codes (see exploit Section 4.3.1) or initiate a
1946-
large number of authorization requests (see exploit Section 4.3.4.1
1947-
and Section 4.3.9) in a short period of time. An authorization
1948-
server MAY apply rate limits to minimize the number of requests it
1949-
would accept from a client or send to a user in a limited time
1950-
period.
1945+
large number of user codes (see exploit described in Section 4.3.1)
1946+
or initiate a large number of authorization requests (see exploits
1947+
described in Section 4.3.4.1 and Section 4.3.9) in a short period of
1948+
time. An authorization server MAY apply rate limits to minimize the
1949+
number of requests it would accept from a client or send to a user in
1950+
a limited time period.
19511951

19521952
*Limitations:* Rate limits are effective at slowing an attacker down
19531953
and help to degrade scaled attacks, but do not prevent more targeted

0 commit comments

Comments
 (0)