Limit the number of POST requests to the reverse proxy login form
The following rate limiting configuration allows an administrator to limit the number of POST requests made to the reverse proxy login form by any one IP address.
It allows a user to try logging for 5 times in a minute. If the user becomes rate limited then a 429 is returned.
This policy can be enhanced by creating a resource that mimics the login-failed. HTML template and rewriting the request to this dummy resource. This stops a brute force attacker from knowing they are rate limited and save resources in the way of reduced LDAP look ups.
#=========================
# Rate limiting pkmslogin
#=========================
# This policy limits the number of times a given IP address can be used to
# attempt to log into the reverse proxy in 60 seconds.
#
# If the reverse proxy is behind a load balancer, instead of the IP Address, a
# header down streamed from the load balancer can be used to downstream the
# client IP address.
#=========================
# Matching criteria
#=========================
# The login form.
# The same principals could be applied to a EAI form too.
resources:
- url: /pkmslogin.form
method:
- POST
#=========================
# Tokenizing Criteria
#=========================
# Use the client IP to identify them
ip: true
# If a load balancer is involved instead use:
#header:
# x-forwarded-for: "*"
#=========================
# Capacity Criteria
#=========================
# The client is allowed to try 20 times in a minute. A more than reasonable
# number for a regular user.
capacity: 20
interval: 60
#=========================
# Reaction
#=========================
# Return a 429.
reaction: TEMPLATE
# Or if there is a dummy login page available:
#reaction: /dummy-login-url