26 lines
731 B
Python
26 lines
731 B
Python
|
"""Scoped throttles used by the search and auth endpoints."""
|
||
|
|
|
||
|
|
from __future__ import annotations
|
||
|
|
|
||
|
|
from rest_framework.throttling import ScopedRateThrottle, SimpleRateThrottle
|
||
|
|
|
||
|
|
|
||
|
|
class SearchRateThrottle(ScopedRateThrottle):
|
||
|
|
"""Rate limit for the (relatively expensive) search endpoints."""
|
||
|
|
|
||
|
|
scope = "search"
|
||
|
|
|
||
|
|
|
||
|
|
class LoginRateThrottle(SimpleRateThrottle):
|
||
|
|
"""
|
||
|
|
Brute-force protection for credential endpoints.
|
||
|
|
|
||
|
|
Keyed on the client IP rather than the user, because the attacker controls
|
||
|
|
the username field.
|
||
|
|
"""
|
||
|
|
|
||
|
|
scope = "login"
|
||
|
|
|
||
|
|
def get_cache_key(self, request, view) -> str | None: # noqa: ANN001, ARG002
|
||
|
|
return self.cache_format % {"scope": self.scope, "ident": self.get_ident(request)}
|