From 36892f950cef4c810bc663687b8a67bf3c9d6880 Mon Sep 17 00:00:00 2001
From: undefined <i@undefined.moe>
Date: Mon, 9 Mar 2026 01:56:41 +0800
Subject: [PATCH] core: oauth: set rate limit for oauth

---
 packages/hydrooj/src/handler/user.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/hydrooj/src/handler/user.ts b/packages/hydrooj/src/handler/user.ts
index c96431b55..576d90504 100644
--- a/packages/hydrooj/src/handler/user.ts
+++ b/packages/hydrooj/src/handler/user.ts
@@ -464,6 +464,7 @@ class OauthCallbackHandler extends Handler {
     async get(args: any) {
         const provider = this.ctx.oauth.providers[args.type];
         if (!provider) throw new UserFacingError('Oauth type');
+        await this.limitRate('oauth_callback', 60, 5);
         const r = await provider.callback.call(this, args);
         if (this.session.oauthBind === args.type) {
             delete this.session.oauthBind;