1

My web app has a pretty standard feature that allows a user who forgot their password to reset it by sending themselves a password reset email with a link to the page to create a new password.

I'm concerned that person1 could use this page to harass person2 by claiming to need a password reset email, but giving the email address of person2, and automate this with a bot, sending massive numbers of emails to person2. It wouldn't reveal any secrets, but it could be very annoying, even a DoS on their inbox, and my application would get the blame.

I understand that I can throttle the api call that sends the email, but how? The user making the api call can't be authenticated, because if they were logged in, they wouldn't need the reset. And if the api call is open, then there's no way to validate the caller, because any general request information (like IP) can be spoofed (or sent through a proxy server).

If I throttle that api call globally, then legitimate users might get locked out if a large number of them just happened to use the feature at the same time.

How do you deal with a situation like this?

Joshua Frank
  • 13,120
  • 11
  • 46
  • 95
  • good question and good idea. i will add this kind of protection in [authentication-flows-js](https://www.npmjs.com/package/authentication-flows-js) – OhadR May 03 '21 at 05:43

1 Answers1

1

Throttle how many mails you will send to the same email address, regardless of how they're requested. This doesn't require you to throttle how many resets you will handle in total; just per address.

Rob Napier
  • 286,113
  • 34
  • 456
  • 610
  • Ah, that's an interesting idea. What would be a throttling protocol that would be enough to allow for legitimate use (including botching it a few times), but not enough that it could still be a problem? Any simple requests/time rule, like no more than one email every six hours would still be vulnerable to person1 sending person2 an email every six hours, which might not be a DoS, but it'd still get really annoying. – Joshua Frank Apr 27 '21 at 21:06