- recordAttempt()/isBlocked() return false when maxAttempts <= 0 or windowSeconds <= 0, so the documented 'set to 0 to disable' actually disables instead of blocking every address permanently
- Keys at their limit are rejected without recording, so repeated attempts at the attacker's pace cannot keep sliding the window and holding the lockout open; a block now clears once the recorded attempts age out of windowSeconds
- Attempts map is bounded: an opportunistic prune (every 60s) erases keys whose attempts have fully aged out
- Login is throttled before the work: isLoginRateLimited() (a new virtual on Server, backed by isBlocked()) gates loginUser(), so a locked-out address no longer burns a database round trip and password verification per attempt
- recordAttemptAt()/isBlockedAt() time seams make the sliding-window behaviour deterministically testable; tests rewritten for the real semantics (no reliance on the maxAttempts=0 bug, no sleeps)
Introduce a thread-safe RateLimiter that tracks attempts per key
(IP address) within a sliding time window, and wire it into the
authentication endpoints:
- Login: failed login attempts from an address are counted; once the
configured maximum is exceeded within the window, further logins
from that address are rejected with RespTooManyRequests. A
successful login clears the failed attempts for that address.
- Registration: implement the previously stubbed
tooManyRegistrationAttempts, limiting how many accounts can be
created per address per window.
- Forgot-password: throttle both the email-request and the
email-challenge paths per address.
New [security] settings with defaults:
max_login_attempts_per_ip=5 / login_attempt_window_seconds=900
max_registrations_per_ip=2 / registration_window_seconds=3600
max_forgot_password_requests_per_ip=3 / forgot_password_window_seconds=3600
Adds unit tests for the RateLimiter (window limit, over-limit
blocking, clearing, per-key independence).
Took 3 minutes
