Skip to content

Only check for blacklisted IPs on Git requests

Heinrich Lee Yu requested to merge 35617-only-blacklist-git-auth into master

What does this MR do?

We block IP addresses when failed Git auths reach a certain threshold.

This block applied to all requests so for every request, we had to check Redis to see if the IP is blocked. This caused unnecessary Redis load.

This MR changes the block to only apply to Git requests as it is described in the documentation

Screenshots

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team

#35617 (closed)

Edited by 🤖 GitLab Bot 🤖

Merge request reports