Skip to content

Enable registration api#3

Open
Rinary1 wants to merge 5 commits into
Space-Wizards-Federation:masterfrom
Rinary1:enable-registration
Open

Enable registration api#3
Rinary1 wants to merge 5 commits into
Space-Wizards-Federation:masterfrom
Rinary1:enable-registration

Conversation

@Rinary1

@Rinary1 Rinary1 commented Jun 22, 2026

Copy link
Copy Markdown

Re-enables registration api with security fixes, summary:

  1. Added Email Validation for Registration and Confirmation.
  2. Added Password minimal and maximum length(from 6 to 100, same as on page)
  3. Added username minimal and maximum length(from 3 to 32, added to registration page)
  4. Added rate limits for registration and confirmation:
    • 2 per hour for confirmation.
    • 5 per 15 minutes for registration.
  5. Added security notice when user tries to register account on already registered email.
  6. Fixed issue when confirmation can be sent on already confirmed email.

Makes some "out of topic" changes so as not to undermine "general equality":

  1. Added Rate Limits for Reset Password and Authenticate.
  2. Removed commented out code(nitpick).
  3. Added Message in Bed Request in Authenticate(nitpick).
  4. Added Email Validation for Reset Password.
  5. Added dummy user check in Unauthorized path so that the response times are roughly the same.
    (The same approach as with the Security Notice; its purpose is simply to make the response times for successful and unsuccessful requests roughly the same, because before, unsuccessful response was faster)

Create conflicts with #2.

@Rinary1 Rinary1 force-pushed the enable-registration branch from 8391fa0 to f7616c9 Compare June 22, 2026 10:29
Comment thread SS14.Auth.Shared/ModelShared.cs
}

// Console.WriteLine(Request.Headers["SS14-Launcher-Fingerprint"]);
// Console.WriteLine(Request.Headers["User-Agent"]);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

   // Console.WriteLine(Request.Headers["SS14-Launcher-Fingerprint"]);
    // Console.WriteLine(Request.Headers["User-Agent"]);

Why was this removed?

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

   // Console.WriteLine(Request.Headers["SS14-Launcher-Fingerprint"]);
    // Console.WriteLine(Request.Headers["User-Agent"]);

Why was this removed?

I'm not sure if this is that important, for me it looks like dead code. If anyone needs to debug it, they can just add it locally, right?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants