Add registration bot traps #2
Loading…
Reference in a new issue
No description provided.
Delete branch "feature/registration-guard-v16"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Security model
This is lightweight friction for opportunistic generic Forgejo signup automation, not a rate limiter. Signed form tokens are valid for 24 hours and can be replayed within that window.
Testing
go test -tags 'sqlite sqlite_unlock_notify' ./services/auth ./modules/setting ./routers/web/auth ./services/forms -count=1go test -tags 'sqlite sqlite_unlock_notify' ./tests/integration -run '^TestSignup' -count=1go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.11.4 run ./services/auth ./modules/setting ./routers/web/auth ./services/formsmake lint-locale lint-locale-usage lint-editorconfiggit diff --checkFull
make lint-goremains blocked only by two pre-existingmodernizefindings inservices/repository/files/suggestion.go./oc review
OpenCode Review
Execution completed for
pleroma/forgejo-customate2628ae0ad49(job #63).Rating: 5/5
The PR adds three bot traps to local signup: an instance-specific challenge question, a hidden honeypot field, and an HMAC-authenticated issuance-timestamp token enforcing a minimum form-completion time. Implementation is sound: the token is domain-separated HMAC-SHA256 over the millisecond timestamp, verified with constant-time comparison, length-checked, overflow-guarded, and rejected when in the future or older than 24h; the honeypot is checked first and both honeypot/invalid-token failures return a generic message without leaking which trap fired; rejection logs contain no submitted values. The guard is wired only into the unauthenticated local signup POST (before captcha), while OAuth/OpenID/link-account paths that require prior external auth are excluded and the template correctly hides the fields in LinkAccountMode, so no bypass exists. Config parsing trims/filters answers, clamps invalid min-form-time to the default, and disables the guard with a startup warning when challenge/answers are empty (deliberate, test-asserted). Verified: services/auth unit tests, setting config tests, and integration tests (TestSignupRegistrationGuard plus existing signup/link-account/auth suites) all pass under go1.26.7 with sqlite tags; gofmt and go vet clean; working tree restored. Token reuse for up to 24h and the fail-open-on-misconfiguration behavior are explicitly documented design decisions, not defects. No blocking or medium-impact issues found; production-ready.
No findings were reported.
Well-implemented registration guard with correct HMAC token handling, sensible check ordering, no PII in logs, and thorough unit plus integration coverage. All relevant tests pass and static checks are clean. The known limitations (24h token reuse window, fail-open when misconfigured) are deliberate and documented in app.example.ini. No actionable defects introduced.
Last reviewed commit:
e2628ae0ad49