When I login with bad credentials, I should get a randomly delayed response

[jazeee]

As a hacker, I may try to dictionary attack the rest server to find user names, emails, and/or passwords.
When I do, the system should make it hard for me to do so by delaying the response.

On authentication failure, the system should delay by a random amount of time, so that I cannot measure the time and determine algorithm factors based on that time.

In addition, when I request data from an authentication protected ReST path, and I use bad token, the system should delay its response in the same way.

See Prevent Brute-Force Attacks: https://www.owasp.org/index.php/Authentication_Cheat_Sheet for other ideas.

I suspect that the system would be fine if it slowed down the response between 0.5 and 5 seconds per failed request. The system should capture how many failed attempts occurred and increase the delay as the count increases.

I'll look at some code that may help.

[jazeee]

I think that I'd put some protection in route.coffee
_respond could check for status code of 401, and add some delays.
A minimal random delay between 500 and 1000 msec would probably be a simple first start.

[kahmali]

This would be a nice update. What would be even better is to build that functionality as a JsonRoutes middleware package, and then update Restivus to allow plugging middleware in (should be pretty easy in 0.7.0, since we use simple:json-routes). That way the functionality could also be used in simple:rest-accounts-password, if @stubailo thinks it's worth supporting there.

I'm thinking it could exist as error middleware, where you could pass a delay property on the next({}) error object (in milliseconds), which would just do the delay and then pass the error through to the next error middleware. That way it could be used for more than just failed password delays. Heck, if someone sees value in delaying for anything else other than errors, it could just be a piece of normal middleware.

Another layer of middleware could then be added that would check for 401s and then generate delayed errors with a random value, as you suggested.

[jazeee]

Ideally, the system should lock out multiple failed requests from an IP source, and lock out multiple failed requests for a particular user, for a set period.

This would require some rework since the authentication code is synchronous.

[jazeee]

Ahh, interesting. I'll think about the middleware path.
I put in a quick fix in my code, but I don't know if that would be worthwhile for the Restivus package. It is quite simple...
Thanks much...