NoBrute 1.1.0

NoBrute (by Malte)

Simple and light bruteforce protection for .NET CORE 3.1+ This Lib will protect defined actions in your controllers in making them inefficient to be bruteforced for simple soulutions. It will append request times in ms if a local cache entry on the server was found for the same request & request name & method and the hit count reaches an defined limit (so called here: greenrequests) in an amount of time.

Requirements

NoBrute will require at least one IMemoryCache or IDistributedCache to be regisrted in your application. (Since for obvious reasons storing the info the session wont work cause bots will never send coookies along them)

Install

Using the nuget package manager:

Install-Package NoBrute

Using the dotnet cli:

dotnet add package NoBrute

Enable it in your application:

// Startup.cs

 public IServiceProvider ConfigureServices(IServiceCollection services) {
     
     // Use Memoory Cache:
    services.AddMemoryCache();
    // Or an distributed cache (NoBrute will prefer this if both registered)
     services.AddStackExchangeRedisCache(x =>
            {
                x.Configuration = "... ";
            }); // In this case we used for example redis

    services.AddNoBrute();
 }

Configuration

In order to use NoBrute there is no configuration required. Here is a JSON Example for your "appsettings.json" to configure NoBrute and what default values are used if the entry does not exists in you configuration:

{
"NoBrute": {
    "Enabled": true,
    "GreenRetries": 10,
    "IncreaseRequestTime": 20,
    "TimeUntilReset": 2,
    "TimeUntilResetUnit": "H",
    "StatusCodesForAutoProcess": [
      200
    ]
  }
}

Configuration Entries and their meanings

Usage

The Action Filter Attribute (WebApi or MVC)

To protect an action you can use the "NoBruteAttribute". This is the simnple way.

Arguments:

Examples

Generated Name

[NoBrute]
public IHttpActionResult Login() {
    ...
}

*Generated Name with auto release

[NoBrute(true)]
public IHttpActionResult Login() {
    ...
}

Fixed Name

[NoBrute("MyFixedName")]
public IHttpActionResult Login() {
    ...
}

Fixed Name with auto release

[NoBrute("MyFixedName", true)]
public IHttpActionResult Login() {
    ...
}

The Service

If you have a more complex design to decide when a request should be checked or not you can also use the Service.

Inject Service

private readonly INoBrute nobrute;

public MyController(INoBrute nobrute) {
    this.nobrute = nobrute;
}

Use it in the method:

public IHttpActionResult MyAction() {
    if (1 > 0)  // or some if else logic
    {
        NoBruteRequestCheck check = this.nobrute.CheckRequest("MyActionRequestName");

        // Some more logic
    }
}

The "CheckRequest" Method will return an Object of type NoBruteRequestCheck. It will contain the flag "IsGreenRequest" and how much time to append to the request. Also some user infos like IP will be returned.

However you have to call the Thread.Sleep by yourself here. The Service will only release and check requests for you but never sleep the requests like the action attribute.

See more at /src/Domain/INoBrute.cs and /src/Models/NoBruteRequestCheck.cs in the Github Repository.

Contribute / Donations

If you got any Ideas to improve my projects feel free to send an pull request.

If you like my work and want to support me (or want to buy me a coffee/beer) paypal donation are more than appreciated.

Changelog