From ed2400f05f46c0ce2ec71f8c3b77a2a88a800774 Mon Sep 17 00:00:00 2001 From: Ksoy Date: Tue, 11 May 2021 10:05:45 +0800 Subject: [PATCH] Add limit 10/hour at route "login". TODO: seprate get and post --- app/view.py | 5 +++++ requirements.txt | 1 + 2 files changed, 6 insertions(+) diff --git a/app/view.py b/app/view.py index bbd2154..c65de9a 100644 --- a/app/view.py +++ b/app/view.py @@ -3,6 +3,8 @@ from flask import (Blueprint, g, render_template as flask_render_template, redirect, request, session) from flask_babel import gettext +from flask_limiter import Limiter +from flask_limiter.util import get_remote_address from werkzeug.security import check_password_hash import config @@ -13,6 +15,8 @@ log = logging.getLogger("\033[1;35m[VIEW]\033[0m") view_api = Blueprint('VIEW', __name__) +limiter = Limiter(view_api, key_func=get_remote_address) + def render_template(*args, **argv): fields = [] @@ -65,6 +69,7 @@ def root(): @view_api.route('/login/', methods=['GET', 'POST'], strict_slashes=False) +@limiter.limit("10 per hour") def login(): if request.method == 'POST': username = request.form.get('username') diff --git a/requirements.txt b/requirements.txt index 717adbc..30d99a4 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,6 +1,7 @@ sqlalchemy~=1.3.19 requests~=2.24.0 flask~=1.1.2 +flask-limiter~=1.4 flask-wtf~=0.14.3 Flask-Babel~=2.0.0 python-dateutil~=2.8.1