Add a user agent with documentation

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>

Author: TG1999

vulnerabilities/middleware/vcio_user_agent.py

@@ -0,0 +1,40 @@
+#
+# Copyright (c) nexB Inc. and others. All rights reserved.
+# VulnerableCode is a trademark of nexB Inc.
+# SPDX-License-Identifier: Apache-2.0
+# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
+# See https://github.com/aboutcode-org/vulnerablecode for support or download.
+# See https://aboutcode.org for more information about nexB OSS projects.
+#
+
+from django.conf import settings
+from django.http import JsonResponse
+
+
+class VCIOUserAgentMiddleware:
+    """
+    Allow API access only when the User-Agent matches VCIO_USER_AGENT.
+    """
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        if request.path.startswith("/api/") and not request.path.startswith(
+            ("/api/docs/", "/api/schema/")
+        ):
+            user_agent = request.headers.get("User-Agent", "")
+            docs_url = request.build_absolute_uri("/api/docs/")
+            if user_agent != settings.VCIO_USER_AGENT:
+                return JsonResponse(
+                    {
+                        "detail": (
+                            "Unauthorized client. Please refer to the API "
+                            "documentation at "
+                            f"{docs_url}"
+                        )
+                    },
+                    status=403,
+                )
+
+        return self.get_response(request)

vulnerablecode/settings.py

@@ -112,6 +112,7 @@
     "vulnerabilities.middleware.ban_user_agent.BanUserAgent",
     "vulnerabilities.middleware.timezone.UserTimezoneMiddleware",
     "vulnerabilities.middleware.altcha_protection.AltchaProtectionMiddleware",
+    "vulnerabilities.middleware.vcio_user_agent.VCIOUserAgentMiddleware",
 )
 
 ROOT_URLCONF = "vulnerablecode.urls"
@@ -195,11 +196,13 @@
 LOGIN_REDIRECT_URL = "/"
 LOGOUT_REDIRECT_URL = "/"
 
-THROTTLE_RATE_ANON = env.str("THROTTLE_RATE_ANON", default="3600/hour")
+THROTTLE_RATE_ANON = env.str("THROTTLE_RATE_ANON", default="10/minute")
 THROTTLE_RATE_UI = env.str("THROTTLE_RATE_UI", default="15/minute")
-THROTTLE_RATE_USER_HIGH = env.str("THROTTLE_RATE_USER_HIGH", default="18000/hour")
-THROTTLE_RATE_USER_MEDIUM = env.str("THROTTLE_RATE_USER_MEDIUM", default="14400/hour")
-THROTTLE_RATE_USER_LOW = env.str("THROTTLE_RATE_USER_LOW", default="10800/hour")
+THROTTLE_RATE_USER_HIGH = env.str("THROTTLE_RATE_USER_HIGH", default="1/second")
+THROTTLE_RATE_USER_MEDIUM = env.str("THROTTLE_RATE_USER_MEDIUM", default="30/minute")
+THROTTLE_RATE_USER_LOW = env.str("THROTTLE_RATE_USER_LOW", default="20/minute")
+
+VCIO_USER_AGENT = env.str("VCIO_USER_AGENT", default="VCIO_API_AGENT")
 
 REST_FRAMEWORK_DEFAULT_THROTTLE_RATES = {
     "anon": THROTTLE_RATE_ANON,
@@ -263,8 +266,12 @@
     "DATETIME_FORMAT": "%Y-%m-%dT%H:%M:%SZ",
 }
 
-api_doc_intro = """
+api_doc_intro = f"""
 <div>
+    <strong>Note:</strong> All API requests must include the following
+    <code>User-Agent</code> header:
+    <pre>User-Agent: {VCIO_USER_AGENT} </pre>
+    Requests without this exact header value will be rejected.
     <p><strong>VulnerableCode</strong> is open data and free software by
     <a href="https://github.com/nexB/vulnerablecode"> nexB Inc. and others.</a>
     </p>