diff options
Diffstat (limited to 'AGENTS.md')
| -rw-r--r-- | AGENTS.md | 5 |
1 files changed, 4 insertions, 1 deletions
@@ -135,7 +135,10 @@ internal/web/ server.go (host router, middleware, render helpers) - **Hardening** (`web/ratelimit.go`): a per-key token bucket throttles the anonymous endpoints worth abusing — `loginLimit` on `POST /webadmin`, keyed by client address *and* by lowercased username (10 at once, then 10 a - minute each), answered with 429 by `s.throttle` and a log line. Flood + minute each), answered with 429 by `s.throttle` and a log line; failed + logins are logged with the username and address, and the login body is + capped at `maxLoginBody` (64 KB) since it is the one POST outside + `guardPOST`. Flood control for everything else stays at the reverse proxy (`limit_req`). - **Templates**: each page file is parsed together with its layout (`layouts/dashboard.html` or `layouts/blog.html` for `blog/*`) and all |