diff options
| author | grm <grm@eyesin.space> | 2026-09-18 13:46:11 +0300 |
|---|---|---|
| committer | grm <grm@eyesin.space> | 2026-09-18 13:46:11 +0300 |
| commit | f8d90e3d80ec798689be5fdf792e6c1401ad748f (patch) | |
| tree | 80e37791696168eb09ccccdec37bfc0f75e4f52d /internal/db/migrations/control/00003_layout.sql | |
| parent | 90578f02d851ab4e28a066404fbcf4be6a0ed9a7 (diff) | |
| download | blogspace-f8d90e3d80ec798689be5fdf792e6c1401ad748f.tar.gz blogspace-f8d90e3d80ec798689be5fdf792e6c1401ad748f.tar.bz2 blogspace-f8d90e3d80ec798689be5fdf792e6c1401ad748f.zip | |
Security: Throttle login attempts with a per-address, per-account token bucket
Nothing stopped a bot from trying passwords against /webadmin as fast
as bcrypt would go. A small in-memory limiter (stdlib only, one
process) now refuses a login with 429 once an address, or an account,
has made ten attempts, and lets one more through every six seconds;
keying on both means many addresses guessing one account are throttled
too. Refusals are logged.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A
Diffstat (limited to 'internal/db/migrations/control/00003_layout.sql')
0 files changed, 0 insertions, 0 deletions