measuredvoice/ringsail — Issue #18: Auth key request form should enforce rate limit
Author: globalspin
Created: 2012-03-07 01:47:08+00:00
State: open
Labels: 2 - To Do

The auth key request form should quietly enforce a rate limit of one key request per hour per email address, to limit the ability of a malicious user to spam government email addresses using the system.

To reproduce:

1. On howto.gov, use the registry to find a social media account.
2. Enter a test email address and phone number and submit. An email should be received with the continue link.
3. Return to the page from step 1, and enter the same address from step 2.

Expected behavior: The second request should display the same "check your email" message but no email should be sent.