diff options
Diffstat (limited to 'internal/web/handlers_auth.go')
| -rw-r--r-- | internal/web/handlers_auth.go | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/internal/web/handlers_auth.go b/internal/web/handlers_auth.go index 1321b2d..1545a4e 100644 --- a/internal/web/handlers_auth.go +++ b/internal/web/handlers_auth.go @@ -52,6 +52,11 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) { s.renderStatus(w, r, http.StatusUnauthorized, "auth/login.html", map[string]any{"error": s.tr(r, "Wrong username or password."), "username": username, "next": next}) } + // Both buckets must have a token: one address guessing many accounts and + // many addresses guessing one account are throttled alike. + if !s.throttle(w, r, s.loginLimit, "ip:"+clientIP(r)) || !s.throttle(w, r, s.loginLimit, "user:"+strings.ToLower(username)) { + return + } u, err := s.st.UserByUsername(r.Context(), username) if err != nil { if !errors.Is(err, store.ErrNotFound) { |