mirror of
https://github.com/0rangebananaspy/authelia.git
synced 2024-09-14 22:47:21 +07:00
3052c883a0
Start the U2F signing request when entering in the second factor page so that the user only has to touch the token without any other clicks.
39 lines
2.1 KiB
Gherkin
39 lines
2.1 KiB
Gherkin
@needs-regulation-config
|
|
Feature: Authelia regulates authentication to avoid brute force
|
|
|
|
@need-registered-user-blackhat
|
|
Scenario: Attacker tries too many authentication in a short period of time and get banned
|
|
Given I visit "https://auth.test.local:8080/"
|
|
And I set field "username" to "blackhat"
|
|
And I set field "password" to "bad-password"
|
|
And I click on "Sign in"
|
|
And I get a notification of type "error" with message "Authentication failed. Please check your credentials."
|
|
And I set field "password" to "bad-password"
|
|
And I click on "Sign in"
|
|
And I get a notification of type "error" with message "Authentication failed. Please check your credentials."
|
|
And I set field "password" to "bad-password"
|
|
And I click on "Sign in"
|
|
And I get a notification of type "error" with message "Authentication failed. Please check your credentials."
|
|
When I set field "password" to "password"
|
|
And I click on "Sign in"
|
|
Then I get a notification of type "error" with message "Authentication failed. Please check your credentials."
|
|
|
|
@need-registered-user-blackhat
|
|
Scenario: User is unbanned after a configured amount of time
|
|
Given I visit "https://auth.test.local:8080/?redirect=https%3A%2F%2Fpublic.test.local%3A8080%2Fsecret.html"
|
|
And I set field "username" to "blackhat"
|
|
And I set field "password" to "bad-password"
|
|
And I click on "Sign in"
|
|
And I get a notification of type "error" with message "Authentication failed. Please check your credentials."
|
|
And I set field "password" to "bad-password"
|
|
And I click on "Sign in"
|
|
And I get a notification of type "error" with message "Authentication failed. Please check your credentials."
|
|
And I set field "password" to "bad-password"
|
|
And I click on "Sign in"
|
|
And I get a notification of type "error" with message "Authentication failed. Please check your credentials."
|
|
When I wait 6 seconds
|
|
And I set field "password" to "password"
|
|
And I click on "Sign in"
|
|
And I use "REGISTERED" as TOTP token handle
|
|
And I click on "Sign in"
|
|
Then I'm redirected to "https://public.test.local:8080/secret.html" |