diff options
| author | Jan Provaznik <jprovaznik@gitlab.com> | 2019-08-23 08:05:49 +0000 |
|---|---|---|
| committer | Jan Provaznik <jprovaznik@gitlab.com> | 2019-08-23 08:05:49 +0000 |
| commit | 46dc507241828f8293127afeb06c25b50bedd845 (patch) | |
| tree | 4009ee7ace0a88bc945b5fd2f901beb63cb525e9 | |
| parent | 8634cca30083746e44121ccef060fd11f548f672 (diff) | |
| parent | d51365efe7378eed087d9d925dec1624cb933ae6 (diff) | |
| download | gitlab-ce-46dc507241828f8293127afeb06c25b50bedd845.tar.gz | |
Merge branch '49392-exempt-jwt-auth-for-user-gitlab-ci-token-from-rate-limiting' into 'master'
Exempt `jwt/auth` for user `gitlab-ci-token` from rate limiting
Closes #49392
See merge request gitlab-org/gitlab-ce!31909
| -rw-r--r-- | changelogs/unreleased/49392-exempt-jwt-auth-for-user-gitlab-ci-token-from-rate-limiting.yml | 5 | ||||
| -rw-r--r-- | lib/gitlab/auth.rb | 6 | ||||
| -rw-r--r-- | spec/lib/gitlab/auth_spec.rb | 4 |
3 files changed, 12 insertions, 3 deletions
diff --git a/changelogs/unreleased/49392-exempt-jwt-auth-for-user-gitlab-ci-token-from-rate-limiting.yml b/changelogs/unreleased/49392-exempt-jwt-auth-for-user-gitlab-ci-token-from-rate-limiting.yml new file mode 100644 index 00000000000..3ce96e64736 --- /dev/null +++ b/changelogs/unreleased/49392-exempt-jwt-auth-for-user-gitlab-ci-token-from-rate-limiting.yml @@ -0,0 +1,5 @@ +--- +title: Exempt user gitlab-ci-token from rate limiting +merge_request: 31909 +author: +type: fixed diff --git a/lib/gitlab/auth.rb b/lib/gitlab/auth.rb index 82e0c7ceeaa..e17a096ef19 100644 --- a/lib/gitlab/auth.rb +++ b/lib/gitlab/auth.rb @@ -46,7 +46,7 @@ module Gitlab user_with_password_for_git(login, password) || Gitlab::Auth::Result.new - rate_limit!(ip, success: result.success?, login: login) + rate_limit!(ip, success: result.success?, login: login) unless skip_rate_limit?(login: login) Gitlab::Auth::UniqueIpsLimiter.limit_user!(result.actor) return result if result.success? || authenticate_using_internal_or_ldap_password? @@ -119,6 +119,10 @@ module Gitlab private + def skip_rate_limit?(login:) + ::Ci::Build::CI_REGISTRY_USER == login + end + def authenticate_using_internal_or_ldap_password? Gitlab::CurrentSettings.password_authentication_enabled_for_git? || Gitlab::Auth::LDAP::Config.enabled? end diff --git a/spec/lib/gitlab/auth_spec.rb b/spec/lib/gitlab/auth_spec.rb index edff38f05ec..098c33f9cb1 100644 --- a/spec/lib/gitlab/auth_spec.rb +++ b/spec/lib/gitlab/auth_spec.rb @@ -86,7 +86,7 @@ describe Gitlab::Auth do let(:project) { build.project } before do - expect(gl_auth).to receive(:rate_limit!).with('ip', success: true, login: 'gitlab-ci-token') + expect(gl_auth).not_to receive(:rate_limit!).with('ip', success: true, login: 'gitlab-ci-token') end it 'recognises user-less build' do @@ -106,7 +106,7 @@ describe Gitlab::Auth do let(:project) { build.project } before do - expect(gl_auth).to receive(:rate_limit!).with('ip', success: false, login: 'gitlab-ci-token') + expect(gl_auth).not_to receive(:rate_limit!).with('ip', success: false, login: 'gitlab-ci-token') end it 'denies authentication' do |