Merge pull request #220 from AuthMe/1073-email-cooldown

Configurable cooldown for /email recovery
2017-02-26 22:44:39 +01:00
parent 8a7c8c36f2 33c4a4690f
commit 57903f1c08
41 changed files with 612 additions and 119 deletions
@@ -114,6 +114,13 @@ public class SecuritySettings implements SettingsHolder {
    public static final Property<Integer> RECOVERY_CODE_HOURS_VALID =
        newProperty("Security.recoveryCode.validForHours", 4);

+    @Comment({
+        "Seconds a user has to wait for before a password recovery mail may be sent again",
+        "This prevents an attacker from abusing AuthMe's email feature."
+    })
+    public static final Property<Integer> EMAIL_RECOVERY_COOLDOWN_SECONDS =
+        newProperty("Security.emailRecovery.cooldown", 60);
+
    private SecuritySettings() {
    }