clawbot e6c326fc96 Rate limit login attempts per client address (closes #66) ...

POST / had no limit, so the signing key could be guessed at no cost. It
is now limited to LoginAttemptsPerMinute (5) attempts per minute per
client by a new RateLimit middleware on github.com/go-chi/httprate. It
counts by the address the ClientIP middleware resolved through
trusted_proxies, an IPv6 client by its /64, and answers an attempt over
the limit with 429 and Retry-After. It runs after the body-size and CSRF
checks, so every attempt that reaches the key comparison is counted. The
image routes can reuse it. README states the limit; TODO narrows the
per-IP item to the image routes.

Model: opus-5-5

2026-09-28 21:22:25 +00:00

..

http_internal_test.go

Harden http.Server: slowloris timeouts and form body limit (closes #92)

2026-09-21 20:59:24 +02:00

http.go

Harden http.Server: slowloris timeouts and form body limit (closes #92)

2026-09-21 20:59:24 +02:00

login_rate_limit_internal_test.go

Test that login attempts are rate limited per client (closes #66)

2026-09-28 21:11:42 +00:00

routes.go

Rate limit login attempts per client address (closes #66)

2026-09-28 21:22:25 +00:00

server.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00