frontend/express/libs/preventBruteforce

Module to record failed attempts and prevent brute force credential guessing

Description:

  • Module to record failed attempts and prevent brute force credential guessing

Source:
Example
var username, pass;
preventBruteforce.isBlocked("login", username, function(isBlocked, fails, err) {
    if (isBlocked) {
        console.log("User is blocked");
        return;
    }
    else {
        if (login()) {
            //user logged in, reset any fails user had
            preventBruteforce.reset("login", username);
        }
        else {
            //user failed to login, increase fails
            preventBruteforce.fail("login", username);
        }
    }
});

Members

(static) blockHooks

Source:
Properties:
Name Type Description
blockHooks object

map path identifiers to functions that are executed when users are blocked e.g. send a mail

(static) db

Source:
Properties:
Name Type Description
db object

Data base connection. Needs to be set befoe callng any other function.

(static) fails

Source:
Properties:
Name Type Description
fails number

How many times user is allowed to fail

(static) mail

Source:
Properties:
Name Type Description
mail object

Mail service to add mailing capabilities

(static) pathIdentifiers

Source:
Properties:
Name Type Description
pathIdentifiers object

Scope or path of check

(static) userIdentifiers

Source:
Properties:
Name Type Description
userIdentifiers object

map paths to functions that extract identifiers from requests i.e. (req) => {ip: req.ip}

(static) wait

Source:
Properties:
Name Type Description
wait number

How long to wait in seconds until removing the block

Methods

(static) fail(pid, uid, callback)

Description:

  • Increase fails for provided namepsace and user

Source:
Example
preventBruteforce.fail("login", username);
Parameters:
Name Type Description
pid string

namespace of the block
uid string

user identifier
callback function

callback to call when done

(static) isBlocked(pid, uid, callback)

Description:

  • Check if user is blocked for provided namepsace and user idendtifier

Source:
Example
var username, pass;
preventBruteforce.isBlocked("login", username, function(isBlocked, fails, err) {
    if (isBlocked) {
        console.log("User is blocked");
        return;
    }
    else {
        if (login()) {
            //user logged in, reset any fails user had
            preventBruteforce.reset("login", username);
        }
        else {
            //user failed to login, increase fails
            preventBruteforce.fail("login", username);
        }
    }
});
Parameters:
Name Type Description
pid string

namespace of the block
uid string

user identifier
callback function

callback to call with result

(static) loginCounterIds(identifier) → {Array.<string>}

Description:

  • Ids of the login failure counters for an identifier: the normalized one the logins count under, then the identifier verbatim, which older versions used

Source:
Parameters:
Name Type Description
identifier string

username or email
Returns:

failed_logins document ids

Type
Array.<string>

(static) loginKey(identifier) → {string}

Description:

  • The key the login failure counter is stored under for a login identifier. It normalizes the identifier the way the credential lookup does: trimmed, and an email in lower case. Usernames are matched case-sensitively, so they keep their case and two members whose names differ only in case keep separate counters. Anything that reads, bumps or clears the "login" counter goes through this.

Source:
Parameters:
Name Type Description
identifier string

username or email as typed, or as stored
Returns:

the counter key

Type
string

(static) middleware(req, res, next)

Description:

  • Middleware to listen to specific paths and check if user is blocked

Source:
Example
app.use(preventBruteforce.middleware);
Parameters:
Name Type Description
req object

request object
res object

response object
next function

callback to call next middleware

(static) registeredPath(path) → {string|null}

Description:

  • Find the registered path a request path is routed to. Express routes case-insensitively and ignores a trailing slash, so /login, /Login and /login/ all reach the same handler and must all be checked.

Source:
Parameters:
Name Type Description
path string

request path
Returns:

the key in pathIdentifiers, or null when the path is not checked

Type
string | null

(static) reset(pid, uid, callback)

Description:

  • Reset fails for provided namepsace and user

Source:
Example
preventBruteforce.reset("login", username);
Parameters:
Name Type Description
pid string

namespace of the block
uid string

user identifier
callback function

callback to call when done

(static) resetForMember(member, callback)

Description:

  • Clear every login failure counter of a member, by username and by email

Source:
Parameters:
Name Type Description
member object

member document
callback function

callback to call when done

(inner) getTimestamp() → {number}

Description:

  • Get current unix timestamp in seconds

Source:
Returns:

current unix timestamp in seconds

Type
number

(inner) normalizePath(path) → {string}

Description:

  • Path as the router compares it: without trailing slashes, in lower case

Source:
Parameters:
Name Type Description
path string

path to normalize
Returns:

normalized path

Type
string