08 · User Management

class SessionsController < ApplicationController
  rate_limit to: 10, within: 3.minutes, only: :create,
             with: -> { redirect_to new_session_url, alert: "Try again later." }
end

# config/initializers/rack_attack.rb: per-account limit across all IPs
Rack::Attack.throttle("logins/email", limit: 20, period: 1.hour) do |req|
  req.params["email_address"].to_s.downcase.presence if req.path == "/session" && req.post?
end

const rateLimit = require("express-rate-limit");
const loginLimiter = rateLimit({
  windowMs: 3 * 60 * 1000, limit: 10,                // 10 per 3 minutes per IP
  standardHeaders: "draft-7", legacyHeaders: false,
  message: "Too many attempts. Try again in a few minutes.",
});
app.post("/login", loginLimiter, loginHandler);
// add a per-account counter (e.g. in Redis keyed by email) to stop botnets
// that rotate IPs, and require a CAPTCHA once it passes a threshold

# Flask: pip install Flask-Limiter
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address
limiter = Limiter(get_remote_address, app=app, storage_uri="redis://localhost")

@app.post("/login")
@limiter.limit("10 per 3 minutes")
def login(): ...

# Django: django-axes locks out by username + IP after N failures
# INSTALLED_APPS += ["axes"]; AXES_FAILURE_LIMIT = 5

# config/initializers/filter_parameter_logging.rb (generated)
Rails.application.config.filter_parameters += [
  :passw, :email, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn, :cvv, :cvc,
  :card_number, :national_id                  # add your own
]

// pino (common Express logger) supports redaction paths
const logger = require("pino")({
  redact: { paths: ["req.body.password", "req.body.card_number",
                    "req.headers.authorization", "req.headers.cookie", "*.token"],
            censor: "[FILTERED]" },
});

# Django: mark views so error reports hide values
from django.views.decorators.debug import sensitive_post_parameters

@sensitive_post_parameters("password", "card_number")
def signup(request): ...

# Generic Python: a logging.Filter that scrubs known keys
class Redact(logging.Filter):
    KEYS = ("passw", "secret", "token", "card")
    def filter(self, record):
        if isinstance(record.args, dict):
            record.args = {k: "[FILTERED]" if any(s in k.lower() for s in self.KEYS) else v
                           for k, v in record.args.items()}
        return True

# VULNERABLE: any logged-in user can read any project
@project = Project.find(params[:id])

# SAFE: scope through the current user; others get 404 (RecordNotFound)
@project = Current.user.projects.find(params[:id])

# shared resources: a policy object (Pundit)
@project = Project.find(params[:id])
authorize @project            # ProjectPolicy#show? decides

// VULNERABLE: any logged-in user can read any project
const p = await db.query("SELECT * FROM projects WHERE id = $1", [req.params.id]);

// SAFE: owner is part of the lookup; others get a 404
const p = await db.query(
  "SELECT * FROM projects WHERE id = $1 AND owner_id = $2",
  [req.params.id, req.user.id]);
if (!p.rows.length) return res.sendStatus(404);

# VULNERABLE (Django)
project = Project.objects.get(pk=pk)

# SAFE: scope through the current user
project = get_object_or_404(Project, pk=pk, owner=request.user)
# or: request.user.projects.get(pk=pk) via the related name