README

Overview

This bundle enhances the login security of your Chameleon application by implementing rate limiting for failed authentication attempts. It helps protect against brute-force attacks by temporarily blocking login attempts for a user or from an IP address after a certain number of failures within a defined period.

Installation

• composer require chameleon-system-private/login-security-bundle
• Register the bundle in AppKernel::registerBundles():

// in AppKernel::registerBundles() or bundles.php
new ChameleonSystem\LoginSecurityBundle\ChameleonSystemLoginSecurityBundle(),

• Run the Chameleon updates.

Configuration

The login security features are configured under the chameleon_system_login_security key in your application's configuration (e.g., config.yml).

Rate Limiting Authentication Failures

To enable rate limiting for authentication failures, add the following configuration:

chameleon_system_login_security:
  rate_limiting:
    log_only: false # If true, rate limiting is only logged, not enforced. Defaults to false.
    user:
      policy: sliding_window # The rate limiting policy to use.
      limit: 10 # Number of requests allowed within the interval.
      interval: '10 minutes' # Time frame for the rate limit.
    ip:
      policy: fixed_window # The rate limiting policy to use.
      limit: 60 # Number of requests allowed within the interval.
      interval: '10 minutes' # Time frame for the rate limit.

Configuration Parameters:

• log_only:

  • Type: boolean
  • Default: false
  • If set to true, rate limiting will only be logged, but no enforcement (blocking) will occur. This is useful for testing and monitoring.

• user: Rate limiting policy applied per user.

  • policy:
    • Type: string
    • Default: no_limit
    • The rate limiting policy to use.
    • Possible values: sliding_window, fixed_window, no_limit.
    • Refer to Symfony documentation for a detailed explanation of policies: https://symfony.com/doc/current/rate_limiter.html
  • limit:
    • Type: integer
    • Default: 10
    • The maximum number of failed authentication attempts allowed for a single user within the specified interval.
  • interval:
    • Type: string
    • Default: '10 minutes'
    • The time frame during which the limit applies. Must be a valid relative date string (e.g., "10 minutes", "1 day", "2 hours"). See https://www.php.net/datetime.formats.relative for valid formats.

• ip: Rate limiting policy applied per IP address.

  • policy:
    • Type: string
    • Default: no_limit
    • Same as user.policy.
  • limit:
    • Type: integer
    • Default: 60
    • The maximum number of failed authentication attempts allowed from a single IP address within the specified interval.
  • interval:
    • Type: string
    • Default: '10 minutes'
    • Same as user.interval.

How Rate Limiting Works:

• Per User: If too many failed login attempts occur for a specific username, that user will be temporarily blocked from logging in. The user attempting to log in will receive a message indicating this.
• Per IP: If too many failed login attempts originate from a single IP address, further login attempts from that IP will be blocked for a certain period. Users attempting to log in from a blocked IP will not be informed of the IP-based block directly.

Important Considerations for IP-based Rate Limiting: Some ISPs use shared IP addresses (e.g., NAT) for multiple clients. This means a single IP address might be used by many users. Adjust your IP-based rate-limiting policy (limit and interval) carefully to avoid unintentionally blocking legitimate users.