Graham McIntire
c10394808a
Removed all unused private functions and imports from BruteForceProtection plug since the feature is currently disabled (Cloudflare handles security). Functions can be restored from git history if feature is re-enabled. Fixed compilation warnings: - unused function track_404_if_needed/2 - unused function maybe_track_404/2 - unused function get_remote_ip/1 - unused function get_fallback_ip/1 - unused function format_remote_ip/1 - unused function check_and_block/2 - unused function block_request/2 - unused function agent_websocket?/1 - unused alias BruteForce - unused import Plug.Conn
39 lines
1.1 KiB
Elixir
39 lines
1.1 KiB
Elixir
defmodule ToweropsWeb.Plugs.BruteForceProtection do
|
|
@moduledoc """
|
|
Plug that detects and blocks brute force scanning behavior.
|
|
|
|
## Detection Strategy
|
|
|
|
Tracks unique 404 paths per IP address using Redis. When an unauthenticated
|
|
IP hits 5+ unique 404s within 60 seconds, a ban is created/escalated.
|
|
|
|
## Ban Escalation
|
|
|
|
- 1st offense: 5-minute ban
|
|
- 2nd offense (within 30 days): 1-hour ban
|
|
- 3rd+ offense (within 30 days): Permanent ban + Cloudflare WAF push
|
|
|
|
## Exemptions
|
|
|
|
- Authenticated users (conn.assigns[:current_user] present)
|
|
- Agent WebSocket connections (/socket/agent - authenticated at channel join)
|
|
- Whitelisted IPs (checked via BruteForce context)
|
|
|
|
## Placement
|
|
|
|
Must be placed in the endpoint.ex pipeline AFTER:
|
|
- RemoteIpLogger (needs remote_ip in Logger metadata)
|
|
- Static file serving (no need to track static assets)
|
|
|
|
Must be placed BEFORE:
|
|
- Router (needs to intercept requests before routing)
|
|
"""
|
|
|
|
def init(opts), do: opts
|
|
|
|
def call(conn, _opts) do
|
|
# TEMPORARILY DISABLED - brute force protection bypassed
|
|
# Cloudflare handles security at the edge
|
|
conn
|
|
end
|
|
end
|