Rate limiting Django admin login with Nginx to prevent dictionary attack
- by shreddies
I'm looking into the various methods of rate limiting the Django admin login to prevent dictionary attacks.
One solution is explained here: simonwillison.net/2009/Jan/7/ratelimitcache/
However, I would prefer to do the rate limiting at the web server side, using Nginx.
Nginx's limit_req module does just that - allowing you to specify the maximum number of requests per minute, and sending a 503 if the user goes over: http://wiki.nginx.org/NginxHttpLimitReqModule
Perfect! I thought I'd cracked it until I realised that Django admin's login page is not in a consistent place, eg /admin/blah/ gives you a login page at that URL, rather than bouncing to a standard login page.
So I can't match on the URL. Can anyone think of another way to know that the admin page was being displayed (regexp the response HTML?)
