hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[#1940] Applied rate limit for requests with bad admin_token. Added doc warnings on admin_token setting.

Browse source
This commit is contained in:
Ivan Tashkinov 2020-07-14 11:58:41 +03:00
commit 9b225db7d8
4 changed files with 28 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/configuration/cheatsheet.md
View file

@ -815,6 +815,8 @@ or
curl -H "X-Admin-Token: somerandomtoken" "http://localhost:4000/api/pleroma/admin/users/invites"
```
Warning: it's discouraged to use this feature because of the associated security risk: static / rarely changed instance-wide token is much weaker compared to email-password pair of a real admin user; consider using HTTP Basic Auth or OAuth-based authentication instead.
### :auth
* `Pleroma.Web.Auth.PleromaAuthenticator`: default database authenticator.