Skip to main content

How to limit requests to a link and stop password guessing

Since app version 1.3.0

On the "Security" tab of a tunnel with an HTTPS link, in the "Tunnel protection" card, set a request limit so that one visitor or program can't flood your app, and guessing protection, which pauses an address that tries passwords or keys one after another.

Request limits​

Over the limit the link answers 429, and the request never reaches your app. Each kind of visitor has its own limit:

  • "Anonymous visitors" — per visitor address: open paths, and a link without a login or key;
  • "Signed in with a login" — per address of a visitor who signed in with a login; it applies when the link has a login;
  • "Programs with a key" — per key.

"Requests per minute" is 1 to 600,000 on average. "At once" is how many requests pass in one go, 1 to 100,000; by default 500, or one second's worth of requests if that is more. An empty "Requests per minute" means no limit, as by default.

  1. Under "Tunnels", open the tunnel with an HTTPS link and go to the "Security" tab.
  2. In the "Tunnel protection" card, pick the "Limits" section.
  3. In the "Request limits for the link" block, fill in "Requests per minute" and, if needed, "At once".
  4. Click "Save".

A limit for anonymous visitors does not close a link with no login, key or path rule: it lets everyone in, but no more often than the limit. Turning it on or off ends the link's open connections once.

Where the plan allows it, a key can have its own limit instead of the common one:

PlanBasicProUltra
Own request limit per keynoyesyes

In the "Sign-in" section, click the "Request limit of the key “…”" icon in the key's row, set the numbers and click "Save"; "Remove own limit" brings back the common one.

On the command line:

proximamp access t1 key limit bot 600 --burst 50  # a key's own limit
proximamp access t1 key limit bot off             # remove it

Password and key guessing protection​

This many wrong passwords or keys from one address within the given time pause it: while the pause lasts, nobody signs in from that address. By default it is 10 wrong attempts in 10 minutes and a 15-minute pause; the period and the pause take 1 to 1440 minutes. A password takes 3 to 100 attempts and its protection can't be switched off; a key takes 0 to 1000, and 0 switches it off.

  1. Under "Tunnels", open the tunnel with an HTTPS link and go to the "Security" tab.
  2. In the "Tunnel protection" card, pick the "Sign-in" section.
  3. In the "Password guessing protection" block, set "Wrong attempts", "Period, minutes" and "Pause, minutes". A link with keys has the same fields in the "Key guessing protection" block.
  4. Click "Save".

The "Paused addresses" block shows the addresses paused now; the "Lift all pauses" button lifts them at once.

End visitors' sessions​

To make everyone who signed in with a login sign in again, click "End visitor sessions" in the "Sign-in" section and confirm with "End sessions"; you will have to sign in again too. To keep someone from signing in again, change their login's password or delete the login (login and password).

On the command line:

proximamp access t1 sign-out-everyone

Check​

Open the link in a private window and enter a wrong password more times than "Wrong attempts" allows: the address shows up under "Paused addresses", and signing in from it fails. "Lift all pauses" lets you back in too. The request limit works if a "… requests refused" line appears next to the limit's name.

On the command line proximamp access t1 shows a pause. proximamp doesn't count refused requests: a limit that worked shows as a 429 answer.