Status/Resolution/Reason: Closed/Deferred/EnhancementRequired
Reporter/Name(from Bugbase): Travis Walters / Travis Walters (Travis Walters)
Created: 03/09/2016
Components: Security
Versions: 2016
Failure Type: Unspecified
Found In Build/Fixed In Build: Alpha_v12 /
Priority/Frequency: Minor / Unknown
Locale/System: English / Win All
Vote Count: 0
Hey There,
I was reading over the OWASP Top Ten Security Cheat Sheet found here:
https://www.owasp.org/index.php/OWASP_Top_Ten_Cheat_Sheet
I was reading the part where it says "Consider the use of a "governor" to regulate the maximum number of requests per second / minute / hour that this user may perform. For example, a typical banking user should not perform more than ten transactions a minute, and one hundred per second is dangerous and should be blocked."
How about we have some cfapplication variables like sessionMaxRequestsPerSecond, sessionMaxRequestsPerMinute, and sessionMaxRequestsPerHour to set some default request throttling limits. From there, it would be nice to have some functions to update those limits for specific users based upon their sessionid; those functions can be used on pages like a login or registration page where members may have higher throttling limits based on what user type they are associated with. It would also be nice to have a function to disable throttling for a specific user.
So what happens when a user exceeds a set limit? Should they be banned and if so, for how long - should it be a set limit? Should they just be redirected to some webpage stating that they have exceeded their request limit?
Perhaps they should be banned if they exceed sessionMaxRequestsPerSecond, sessionMaxRequestsPerMinute, and sessionMaxRequestsPerHour; having said that, maybe we can have a variable like sessionRequestsLimitWarningPercentage where we could set a percentage of the max level to initiate some warning page?
Throttling would be nice especially for websites being attacked by brute force, etc.
There is probably some way to do this at IIS, Apache, or whatever web server you use but since this version of ColdFusion is focusing on Security issues as one of its main concerns, I thought i would suggest this.
Sincerely,
Travis Walters
----------------------------- Additional Watson Details -----------------------------
Watson Bug ID: 4126664
External Customer Info:
External Company:
External Customer Name: Travis Walters
External Customer Email: TWALTERS84@HOTMAIL.COM
External Test Config:Attachments:
Comments: