clawbot e410146fb6 Rate limit login attempts per client address (closes #66) ...

POST / had no limit, so the signing key could be guessed at no cost. It
is now limited to 5 attempts per minute per client by a new RateLimit
middleware on github.com/go-chi/httprate; an attempt over the limit gets
429 with Retry-After. It counts by the address the ClientIP middleware
resolved through trusted_proxies (an IPv4-mapped address as its IPv4
address, IPv6 by its /64) and runs after the body-size and CSRF checks,
so every attempt that reaches the key comparison is counted. README says
that with the default trusted_proxies a client with a private address
can choose its counted address, and how to close that.

Model: opus-5-5

2026-09-29 01:03:37 +02:00

..

http_internal_test.go

Harden http.Server: slowloris timeouts and form body limit (closes #92)

2026-09-21 20:59:24 +02:00

http.go

Harden http.Server: slowloris timeouts and form body limit (closes #92)

2026-09-21 20:59:24 +02:00

login_rate_limit_internal_test.go

Rate limit login attempts per client address (closes #66)

2026-09-29 01:03:37 +02:00

routes.go

Rate limit login attempts per client address (closes #66)

2026-09-29 01:03:37 +02:00

server.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00