diff options
| author | grm <grm@eyesin.space> | 2026-09-18 13:46:11 +0300 |
|---|---|---|
| committer | grm <grm@eyesin.space> | 2026-09-18 13:46:11 +0300 |
| commit | f8d90e3d80ec798689be5fdf792e6c1401ad748f (patch) | |
| tree | 80e37791696168eb09ccccdec37bfc0f75e4f52d /internal/web/server.go | |
| parent | 90578f02d851ab4e28a066404fbcf4be6a0ed9a7 (diff) | |
| download | blogspace-f8d90e3d80ec798689be5fdf792e6c1401ad748f.tar.gz blogspace-f8d90e3d80ec798689be5fdf792e6c1401ad748f.tar.bz2 blogspace-f8d90e3d80ec798689be5fdf792e6c1401ad748f.zip | |
Security: Throttle login attempts with a per-address, per-account token bucket
Nothing stopped a bot from trying passwords against /webadmin as fast
as bcrypt would go. A small in-memory limiter (stdlib only, one
process) now refuses a login with 429 once an address, or an account,
has made ten attempts, and lets one more through every six seconds;
keying on both means many addresses guessing one account are throttled
too. Refusals are logged.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A
Diffstat (limited to 'internal/web/server.go')
| -rw-r--r-- | internal/web/server.go | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/internal/web/server.go b/internal/web/server.go index f005b76..12440de 100644 --- a/internal/web/server.go +++ b/internal/web/server.go @@ -25,10 +25,15 @@ type Server struct { tpl *templates root http.Handler blog http.Handler + // Anonymous endpoints worth abusing get a token bucket each (ratelimit.go). + loginLimit *limiter // per client address and per username: 10 guesses, then 10 a minute } +// logf is log.Printf, a variable so tests can silence it. +var logf = log.Printf + func NewServer(cfg *config.Config, st *store.Store) *Server { - s := &Server{cfg: cfg, st: st, tpl: newTemplates(cfg.Dev)} + s := &Server{cfg: cfg, st: st, tpl: newTemplates(cfg.Dev), loginLimit: newLimiter(10, 10)} s.root = s.rootRoutes() s.blog = s.subdomainRoutes() return s |