Security

Rate Limiting

Rate limiting can be used to restrict how often someone can execute an operation in a defined time frame. For app framework controllers it is recommended to use rate limiting attributes.

Outside controllers, e.g. in DAV code, it's also possible to guard operations by :ref:`injecting<dependency-injection>` \OCP\Security\RateLimiting\ILimiter and registering requests before the operation:

Remote Host Validation

Nextcloud can help validating a remote host so that no internal infrastructure is contacted by user-provided host names or IPs. The validator \OCP\Security\IRemoteHostValidator can be :ref:`injected<dependency-injection>` into any app class:

<?php

use OCP\Security\IRemoteHostValidator;

class MyRemoteServerIntegration {
    private IRemoteHostValidator $hostValidator;

    public function __construct(IRemoteHostValidator $hostValidator) {
        $this->hostValidator = $hostValidator;
    }

    public function contactRemoteServer(string $hostname): void {
        if (!$this->hostValidator->isValid($hostname)) {
            // ABORT
        }

        // Contact the server
    }
}

Trusted domain

In some cases it might be required that an app checks that a user given link is one of the current instance. This is possible with the OCP\Security\ITrustedDomainHelper:

<?php

declare(strict_types=1);
use OCP\Security\ITrustedDomainHelper;

$helper = \OC::$server->get(ITrustedDomainHelper::class);

// Compare a full URL example given
$url = 'https://localhost/nextcloud/index.php/apps/files/';
$helper->isTrustedUrl($url);

// Compare a domain and port
$domain = 'example.tld:8443';
$helper->isTrustedDomain($domain);