34 lines
1.0 KiB
Bash
34 lines
1.0 KiB
Bash
|
#!/bin/bash
|
||
|
|
|
||
|
|
# Simple rate limit testing script for Immich-Folio
|
||
|
|
# It fires 15 rapid POST requests to the /api/auth endpoint.
|
||
|
|
|
||
|
|
ENDPOINT="http://localhost:3000/api/auth"
|
||
|
|
PAYLOAD='{"slug": "test", "password": "wrong"}'
|
||
|
|
|
||
|
|
echo "======================================"
|
||
|
|
echo "🛡️ Starting Rate-Limit Pentest..."
|
||
|
|
echo "Target: $ENDPOINT"
|
||
|
|
echo "Expected behavior: First 10 requests should be 40x (e.g. 401/400), subsequent requests should be 429."
|
||
|
|
echo "======================================"
|
||
|
|
|
||
|
|
for i in {1..15}
|
||
|
|
do
|
||
|
|
echo -n "Request #$i: "
|
||
|
|
|
||
|
|
# Fetch the HTTP status code
|
||
|
|
HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X POST -H "Content-Type: application/json" -d "$PAYLOAD" $ENDPOINT)
|
||
|
|
|
||
|
|
if [ "$HTTP_STATUS" == "429" ]; then
|
||
|
|
echo "🚨 HTTP 429 (Too Many Requests) -> RATE LIMIT TRIGGERED!"
|
||
|
|
else
|
||
|
|
echo "🟢 HTTP $HTTP_STATUS -> Allowed"
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Sleep a tiny bit to avoid completely saturating local resources, but fast enough to hit the 10 RPM limit
|
||
|
|
sleep 0.2
|
||
|
|
done
|
||
|
|
|
||
|
|
echo "======================================"
|
||
|
|
echo "Pentest completed! ✨"
|