Hamza/intaleq_v2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security Hardening: Implement RateLimiter for OTP, add strict validation for Admin device_number, and reduce HMAC tolerance to 60s

Browse Source
This commit is contained in:
Hamza-Ayed
2026-04-24 22:07:34 +03:00
parent 2b9176e229
commit cc85fe1815
2 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
app/Http/Controllers/OtpController.php
View File

@@ -6,6 +6,7 @@ use Illuminate\Http\Request;
use Illuminate\Http\JsonResponse; use Illuminate\Http\JsonResponse;
use Illuminate\Support\Facades\DB; use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Cache; use Illuminate\Support\Facades\Cache;
use Illuminate\Support\Facades\RateLimiter;
use Illuminate\Support\Str; use Illuminate\Support\Str;
use App\Services\LegacyEncryption; use App\Services\LegacyEncryption;
@@ -41,11 +42,10 @@ class OtpController extends Controller
// Rate limit: 3 OTP per phone per 5 minutes // Rate limit: 3 OTP per phone per 5 minutes
$key = "otp_limit_{$userType}:{$phone}"; $key = "otp_limit_{$userType}:{$phone}";
if (Cache::get($key, 0) >= 3) { if (RateLimiter::tooManyAttempts($key, 3)) {
return $this->failure('Too many OTP requests', 429); return $this->failure('Too many OTP requests. Please try again later.', 429);
} }
Cache::increment($key); RateLimiter::hit($key, 300);
Cache::put($key, Cache::get($key), 300);
// Generate 5-digit OTP // Generate 5-digit OTP
$otp = (string) random_int(10000, 99999); $otp = (string) random_int(10000, 99999);
@@ -134,7 +134,7 @@ class OtpController extends Controller
'phone' => 'required|string', 'phone' => 'required|string',
'otp' => 'required|string', 'otp' => 'required|string',
'user_type' => 'nullable|in:passenger,driver,admin', 'user_type' => 'nullable|in:passenger,driver,admin',
'device_number' => 'nullable|string', // Used for admin 'device_number' => 'nullable|string|max:64|regex:/^[a-zA-Z0-9_\-\.]+$/', // Used for admin
]); ]);
$phone = $request->input('phone'); $phone = $request->input('phone');

2
config/intaleq.php
View File

@@ -18,7 +18,7 @@ return [
? trim(file_get_contents('/home/intaleq-api/.secret_key')) ? trim(file_get_contents('/home/intaleq-api/.secret_key'))
: env('JWT_SECRET'), : env('JWT_SECRET'),
'hmac_tolerance' => env('HMAC_TOLERANCE_SECONDS', 300), 'hmac_tolerance' => env('HMAC_TOLERANCE_SECONDS', 60),
// Encryption - قراءة مفتاح التشفير من الملف // Encryption - قراءة مفتاح التشفير من الملف
'legacy_enc_key_path' => '/home/intaleq-api/.enckey', 'legacy_enc_key_path' => '/home/intaleq-api/.enckey',