From 39ba0a3cd7395114c9c81f2f5fd02d1cc58bb751 Mon Sep 17 00:00:00 2001 From: Mattermost Build Date: Mon, 16 Feb 2026 12:39:39 +0200 Subject: [PATCH] MM-66886 Add rate limiting to login endpoint (#34943) (#35314) Automatic Merge --- server/channels/api4/handlers.go | 4 ++++ server/channels/api4/user.go | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/server/channels/api4/handlers.go b/server/channels/api4/handlers.go index 32a96e74dc..fb4265b76c 100644 --- a/server/channels/api4/handlers.go +++ b/server/channels/api4/handlers.go @@ -220,6 +220,10 @@ func (api *API) APILocal(h handlerFunc, opts ...APIHandlerOption) http.Handler { } func (api *API) RateLimitedHandler(apiHandler http.Handler, settings model.RateLimitSettings) http.Handler { + if !*api.srv.Config().RateLimitSettings.Enable { + return apiHandler + } + settings.SetDefaults() rateLimiter, err := app.NewRateLimiter(&settings, []string{}) diff --git a/server/channels/api4/user.go b/server/channels/api4/user.go index c14198e911..ccfdbaf9dc 100644 --- a/server/channels/api4/user.go +++ b/server/channels/api4/user.go @@ -64,7 +64,7 @@ func (api *API) InitUser() { api.BaseRoutes.User.Handle("/mfa", api.APISessionRequiredMfa(updateUserMfa)).Methods(http.MethodPut) api.BaseRoutes.User.Handle("/mfa/generate", api.APISessionRequiredMfa(generateMfaSecret)).Methods(http.MethodPost) - api.BaseRoutes.Users.Handle("/login", api.APIHandler(login)).Methods(http.MethodPost) + api.BaseRoutes.Users.Handle("/login", api.RateLimitedHandler(api.APIHandler(login), model.RateLimitSettings{PerSec: model.NewPointer(5), MaxBurst: model.NewPointer(10)})).Methods(http.MethodPost) api.BaseRoutes.Users.Handle("/login/sso/code-exchange", api.APIHandler(loginSSOCodeExchange)).Methods(http.MethodPost) api.BaseRoutes.Users.Handle("/login/desktop_token", api.RateLimitedHandler(api.APIHandler(loginWithDesktopToken), model.RateLimitSettings{PerSec: model.NewPointer(2), MaxBurst: model.NewPointer(1)})).Methods(http.MethodPost) api.BaseRoutes.Users.Handle("/login/switch", api.APIHandler(switchAccountType)).Methods(http.MethodPost)