BAN_VIOLATIONS=false doesnt have any effect

[spanda1985]

What happened?

I am trying the variable BAN_VIOLATIONS=false and it still pronts too many login attempts.
Is this expected as what ever we add true or false it just works as if its true.

As per doc :

BAN_VIOLATIONS | boolean | Whether or not to enable banning users for violations (they will still be logged).

Steps to Reproduce

1. .env file add BAN_VIOLATIONS=true - exceed max login attempts it shows {"message":"Too many login attempts, please try again after 2 minutes."}

2. .env file add BAN_VIOLATIONS=false - exceed max login attempts it shows {"message":"Too many login attempts, please try again after 2 minutes."}

What browsers are you seeing the problem on?

Chrome, Safari

Relevant log output

No response

Screenshots

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[danny-avila]

Too many login attempts

This is not the result of a ban, it's the result of the login limiter, which is configurable, as well.

More info: https://www.librechat.ai/docs/configuration/mod_system

[spanda1985]

Can you help which configuration it is that i should change? I dnt want to remove loginlimiter..

BAN_VIOLATIONS=false
BAN_DURATION=1000 * 60 * 60 * 2
BAN_INTERVAL=20

LOGIN_VIOLATION_SCORE=1
REGISTRATION_VIOLATION_SCORE=1
CONCURRENT_VIOLATION_SCORE=1
MESSAGE_VIOLATION_SCORE=1
NON_BROWSER_VIOLATION_SCORE=20

LOGIN_MAX=7
#In minutes, determines the window of time for LOGIN_MAX logins. Defaults to 5.
LOGIN_WINDOW=2
REGISTER_MAX=5
REGISTER_WINDOW=60

LIMIT_CONCURRENT_MESSAGES=true
CONCURRENT_MESSAGE_MAX=2

LIMIT_MESSAGE_IP=true
MESSAGE_IP_MAX=40
MESSAGE_IP_WINDOW=1

LIMIT_MESSAGE_USER=false
MESSAGE_USER_MAX=40
MESSAGE_USER_WINDOW=1

ILLEGAL_MODEL_REQ_SCORE=5

#========================#

Balance

#========================#

CHECK_BALANCE=false

[danny-avila]

LOGIN_MAX and LOGIN_WINDOW, adjust as desired.

[spanda1985]

Though i agree with you.. it is like making LOGIN_VIOLATION_SCORE = 0?
Please point in the right direction if i misunderstood?

[spanda1985]

ignore the question.. looks like there is no way to get rid of the loginlimiter.

[spanda1985]

@danny-avila
So the only way to configure the loginlimiter is to increase the login_max?
Also is this User specific or IP specific? What if multiple users share same IP? (sounds naive?)

Thanks in advance.

[danny-avila]

What if multiple users share same IP? (sounds naive?)

This isn't a common scenario, there's no authenticated user yet during login attempts, though tracking login attempts by specific email (not authenticated user) can be useful in conjunction with the current IP solution, it also presents its own problems.

For the uncommon scenario, the login window can be increased/decreased via environment variable, LOGIN_MAX and LOGIN_WINDOW, adjusting as desired: https://www.librechat.ai/docs/configuration/mod_system

If the LibreChat API is sitting behind a reverse-proxy/load-balancer, we can still receive the origin IP if it's properly forwarded.

app.set('trust proxy', 1);

You can also experiment with this for testing:

app.set('trust proxy', true);

This should in theory help express.js identify the req.ip, though we can investigate further in Express and load balancer context:

Worth checking:

• That your proxy/load balancer is correctly forwarding the client IP.
• The 'trust proxy' setting in your Express.js configuration.
• The contents of headers like X-Forwarded-For in your incoming requests, on LibreChat side.

simple log statements within the login limiter handler, in api/server/middleware/limiters/loginLimiter.js should help determine this:

console.log('req.ip:', req.ip);
console.log('X-Forwarded-For:', req.headers['x-forwarded-for']);
console.log('X-Real-IP:', req.headers['x-real-ip']);

If all else fails, and if disabling the loginLimiter is an option for you, commenting its usage is easy enough but not recommended.