Add login rate limiting and lockout protection #6

New issue

Open

opened 2026-07-01 01:00:53 +00:00 by manlycucumber · 0 comments

manlycucumber commented

2026-07-01 01:00:53 +00:00

(Migrated from github.com)

Problem

The login endpoint is a brute-force target. We need throttling that resists credential-stuffing without locking legitimate operators out permanently.

Acceptance criteria

Repeated failed logins for an account trigger an escalating delay or temporary lockout
Lockout state is keyed per-account and per-IP and expires automatically
Lockouts and repeated failures are recorded in an admin-visible audit log
Rate-limit counters do not store raw credentials

Notes

Privacy-first: store only what is needed to throttle; purge counters on expiry.

## Problem The login endpoint is a brute-force target. We need throttling that resists credential-stuffing without locking legitimate operators out permanently. ## Acceptance criteria - [ ] Repeated failed logins for an account trigger an escalating delay or temporary lockout - [ ] Lockout state is keyed per-account and per-IP and expires automatically - [ ] Lockouts and repeated failures are recorded in an admin-visible audit log - [ ] Rate-limit counters do not store raw credentials ## Notes Privacy-first: store only what is needed to throttle; purge counters on expiry.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Directorium/Site#6

No description provided.

Rows
Columns