Thanks to visit codestin.com
Credit goes to github.com

Skip to content

feat: add rate limiting to email verification on profile update #4839

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DonnieBLT merged 3 commits into from
Nov 16, 2025
Merged

feat: add rate limiting to email verification on profile update #4839

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f3fec39
feat: add rate limiting for email change verification
Tia-ani Nov 16, 2025
89ce42c
fix: use atomic cache.add() for rate limit
Tia-ani Nov 16, 2025
f814647
chore: improve UX message and use warning level for rate limit
Tia-ani Nov 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions website/views/user.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
from django.contrib.auth.mixins import LoginRequiredMixin
from django.contrib.auth.models import User
from django.contrib.sites.shortcuts import get_current_site
from django.core.cache import cache
from django.core.mail import send_mail
from django.db.models import Count, F, Q, Sum
from django.db.models.functions import ExtractMonth
Expand Down Expand Up @@ -187,6 +188,17 @@ def profile_edit(request):
defaults={"verified": False, "primary": False},
)

# Rate limit: atomic check-and-set to prevent race conditions
rate_key = f"email_verification_rate_{request.user.id}"

# add() only sets if key doesn't exist (atomic operation)
if not cache.add(rate_key, True, timeout=60):
messages.warning(
request,
"Too many requests. Please wait a minute before trying again.",
)
return redirect("profile", slug=request.user.username)

# Send verification email
try:
send_email_confirmation(request, request.user, email=new_email)
Expand Down
Loading