{"action":"created","issue":{"url":"https://api.github.com/repos/nestjs/nest/issues/1089","repository_url":"https://api.github.com/repos/nestjs/nest","labels_url":"https://api.github.com/repos/nestjs/nest/issues/1089/labels{/name}","comments_url":"https://api.github.com/repos/nestjs/nest/issues/1089/comments","events_url":"https://api.github.com/repos/nestjs/nest/issues/1089/events","html_url":"https://github.com/nestjs/nest/issues/1089","id":360094610,"node_id":"MDU6SXNzdWUzNjAwOTQ2MTA=","number":1089,"title":"Bruteforce protection build in?","user":{"login":"ToonvanStrijp","id":11893063,"node_id":"MDQ6VXNlcjExODkzMDYz","avatar_url":"https://avatars2.githubusercontent.com/u/11893063?v=4","gravatar_id":"","url":"https://api.github.com/users/ToonvanStrijp","html_url":"https://github.com/ToonvanStrijp","followers_url":"https://api.github.com/users/ToonvanStrijp/followers","following_url":"https://api.github.com/users/ToonvanStrijp/following{/other_user}","gists_url":"https://api.github.com/users/ToonvanStrijp/gists{/gist_id}","starred_url":"https://api.github.com/users/ToonvanStrijp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ToonvanStrijp/subscriptions","organizations_url":"https://api.github.com/users/ToonvanStrijp/orgs","repos_url":"https://api.github.com/users/ToonvanStrijp/repos","events_url":"https://api.github.com/users/ToonvanStrijp/events{/privacy}","received_events_url":"https://api.github.com/users/ToonvanStrijp/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-09-13T22:49:57Z","updated_at":"2018-09-14T07:28:11Z","closed_at":null,"author_association":"NONE","body":"<!--\r\nPLEASE HELP US PROCESS GITHUB ISSUES FASTER BY PROVIDING THE FOLLOWING INFORMATION.\r\n\r\nISSUES MISSING IMPORTANT INFORMATION MAY BE CLOSED WITHOUT INVESTIGATION.\r\n-->\r\n\r\n## I'm submitting a...\r\n<!-- \r\nPlease search GitHub for a similar issue or PR before submitting.\r\nCheck one of the following options with \"x\" -->\r\n<pre><code>\r\n[ ] Regression <!--(a behavior that used to work and stopped working in a new release)-->\r\n[ ] Bug report\r\n[ X ] Feature request\r\n[ ] Documentation issue or request\r\n[ ] Support request => Please do not submit support request here, instead post your question on Stack Overflow.\r\n</code></pre>\r\n\r\n## What is the motivation / use case for changing the behavior?\r\n<!-- Describe the motivation or the concrete use case. -->\r\nWouldn't it be nice if nest had a build in bruteforce protection? Or are there some easy ways to implement this? I guess we can write some custom pipes for this and then use for example [express-brute](https://www.npmjs.com/package/express-brute)?"},"comment":{"url":"https://api.github.com/repos/nestjs/nest/issues/comments/421257394","html_url":"https://github.com/nestjs/nest/issues/1089#issuecomment-421257394","issue_url":"https://api.github.com/repos/nestjs/nest/issues/1089","id":421257394,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMTI1NzM5NA==","user":{"login":"BrunnerLivio","id":9899423,"node_id":"MDQ6VXNlcjk4OTk0MjM=","avatar_url":"https://avatars2.githubusercontent.com/u/9899423?v=4","gravatar_id":"","url":"https://api.github.com/users/BrunnerLivio","html_url":"https://github.com/BrunnerLivio","followers_url":"https://api.github.com/users/BrunnerLivio/followers","following_url":"https://api.github.com/users/BrunnerLivio/following{/other_user}","gists_url":"https://api.github.com/users/BrunnerLivio/gists{/gist_id}","starred_url":"https://api.github.com/users/BrunnerLivio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BrunnerLivio/subscriptions","organizations_url":"https://api.github.com/users/BrunnerLivio/orgs","repos_url":"https://api.github.com/users/BrunnerLivio/repos","events_url":"https://api.github.com/users/BrunnerLivio/events{/privacy}","received_events_url":"https://api.github.com/users/BrunnerLivio/received_events","type":"User","site_admin":false},"created_at":"2018-09-14T07:28:11Z","updated_at":"2018-09-14T07:28:11Z","author_association":"MEMBER","body":"@ToonvanStrijp I do not think this should be offered by default, but it is definitely doable to integrate it with the Nest infrastructure. \r\n\r\n\r\n---\r\n\r\n@marcus-sa you're right but I do not think this is the scope.\r\n\r\nRegarding the botnet brute force protection, quote from the owner of express-brute @AdamPflug\r\n\r\n> It's got some defaults that should work pretty well, but it's not going to protect you from a concentrated DDoS attack - for that you probably need some network level help from a CDN like cloudflare.\r\n\r\n> It should help protect open APIs to some extent, and does a pretty good job of protecting against brute force attacks on passwords as long as it's configured correctly. It's not a silver bullet though, if they have access to thousands of computers (IPs) to throw at you, they'll get thousands of times the throughput that you've tuned express-brute for - as long as you're pretty conservative and have good password policies that is probably fine, but in some situations it certainly could be an issue.\r\n\r\n> Basically, if you're in a situation where you can't trust the number of IPs an attacker has access to be limited enough to make IP-based access control effective (e.g. bot nets, government actors, etc), you need to fall back on other options. That could be lower-level and regional filtering like CloudFlare provides, or it could be higher level filtering like Captchas or some kind of validation that is prohibitively expensive to spoof (SMS verification of accounts for example).\r\n\r\n"}}
{"actor":{"display_login":"BrunnerLivio"}}