Rate Limiting

DefectDojo has protection against brute force attacks through rate limiting

Configuration

For further information, please visit the package documentation Django Ratelimit

Enable Rate Limiting

To enable and configure rate limiting, edit the settings (see Configuration) and edit/replace the following information:

DD_RATE_LIMITER_ENABLED=(bool, True),
DD_RATE_LIMITER_RATE=(str, '5/m'),
DD_RATE_LIMITER_BLOCK=(bool, True),
DD_RATE_LIMITER_ACCOUNT_LOCKOUT=(bool, True),

Rate Limit

The frequency at which the request will be limited can be set to

• seconds - 1s
• minutes - 5m
• hours - 100h
• days - 2400d

Extended configuration can be found here

Block Requests

By default, rate limiting is set to record offenses, but does not actually block requests and enforce the limit.

Setting DD_RATE_LIMITER_BLOCK will block all incoming requests at the configured frequncy once that frequency has been exceeded.

Account Lockout

In the event of a brute force attack, a users credentials could potentially be comprimised.

In an attempt to circumvent that event, setting DD_RATE_LIMITER_ACCOUNT_LOCKOUT will force a user to reset their password upon the next attempted login.

Multi-Process Behavior

When using configurations with multiple uwsgi processes, the rate limiting package uses the default cache that is memory based and local to a process.

Extra Configuation

For further information, please visit the package documentation Django Ratelimit