Skip to content

fix: add rate limiting to account details update operation#1729

Open
edward-ly wants to merge 1 commit intomasterfrom
fix/noid/account-rate-limit
Open

fix: add rate limiting to account details update operation#1729
edward-ly wants to merge 1 commit intomasterfrom
fix/noid/account-rate-limit

Conversation

@edward-ly
Copy link
Copy Markdown
Collaborator

Currently, the default rate for this is approximately once every minute, which should be sufficient enough for our needs.

Currently, the default rate for this is approximately once every minute,
which should be sufficient enough for our needs.

Signed-off-by: Edward Ly <contact@edward.ly>
@edward-ly edward-ly requested a review from oleksandr-nc March 25, 2026 16:33
@oleksandr-nc
Copy link
Copy Markdown
Collaborator

oleksandr-nc commented Mar 26, 2026

Can we add a separate "change_email": "3/h/user" to the ACCOUNT_RATE_LIMITS ?

And in the views.py file we can add ratelimit to the AccountView's form_valid after the comparsions of the emails.

What do you think about such approach CONs and PROs?

And it will be good to have a separate file with tests for this, like:

Scenario 1: Normal account update WITHOUT email change
Scenario 2: Normal email change (within rate limit)
Scenario 3: Email change blocked after exceeding rate limit
Scenario 4: User.email must NOT change when rate-limited
Scenario 5: Name changes still save when email is rate-limited
Scenario 6: Rate limit is independent from reset_password
Scenario 7: Invalid form (wrong password) does NOT consume rate limit
Scenario 8: Same email (no change) does NOT consume rate limit

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants