diff options
| author | grm <grm@eyesin.space> | 2026-09-18 13:46:11 +0300 |
|---|---|---|
| committer | grm <grm@eyesin.space> | 2026-09-18 13:46:11 +0300 |
| commit | f8d90e3d80ec798689be5fdf792e6c1401ad748f (patch) | |
| tree | 80e37791696168eb09ccccdec37bfc0f75e4f52d /internal/i18n | |
| parent | 90578f02d851ab4e28a066404fbcf4be6a0ed9a7 (diff) | |
| download | blogspace-f8d90e3d80ec798689be5fdf792e6c1401ad748f.tar.gz blogspace-f8d90e3d80ec798689be5fdf792e6c1401ad748f.tar.bz2 blogspace-f8d90e3d80ec798689be5fdf792e6c1401ad748f.zip | |
Security: Throttle login attempts with a per-address, per-account token bucket
Nothing stopped a bot from trying passwords against /webadmin as fast
as bcrypt would go. A small in-memory limiter (stdlib only, one
process) now refuses a login with 429 once an address, or an account,
has made ten attempts, and lets one more through every six seconds;
keying on both means many addresses guessing one account are throttled
too. Refusals are logged.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A
Diffstat (limited to 'internal/i18n')
| -rw-r--r-- | internal/i18n/el.go | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/internal/i18n/el.go b/internal/i18n/el.go index 6a97c83..e2523cb 100644 --- a/internal/i18n/el.go +++ b/internal/i18n/el.go @@ -269,6 +269,7 @@ var el = map[string]string{ "New passwords do not match.": "Οι νέοι κωδικοί δεν ταιριάζουν.", "Password changed.": "Ο κωδικός άλλαξε.", "Wrong username or password.": "Λάθος όνομα χρήστη ή κωδικός.", + "Too many requests. Try again in a minute.": "Πάρα πολλές προσπάθειες. Δοκιμάστε ξανά σε ένα λεπτό.", // ---- layout ---- "Header": "Κεφαλίδα", |