4 Commits

Include renames

Author	SHA1	Message	Date
sneak	e0f86b148c	Logging in returns to the page that was asked for (closes #384) ... RequireAuth now sends a logged-out GET to /pages/login with its path and query in a `next` parameter when they fit in 2048 bytes, the same limit the login page applies. The login form carries it as a hidden field, and a successful login redirects there when it is a path on this site; anything else, plain or percent-encoded, goes to `/`, which leads to the webhook list. A browser already logged in that opens the login page goes to the same place. The navigation bar on the login page no longer links to the login page. Model: opus-5-5	2026-10-02 03:12:15 +00:00
clawbot	515c359e56	Trust the RFC 1918 ranges as proxies when TRUSTED_PROXIES is unset (closes #333) ... Unset or empty, TRUSTED_PROXIES now defaults to 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, so a reverse proxy reaching webhooker from one of those ranges gets per-client rate-limit buckets with nothing set. A set value replaces the default entirely; an unparseable one still fails startup. The startup warning for an empty list is gone. The README gives the default, one rule (if any client can reach webhooker, or the proxy in front of it, from an RFC 1918 source address, set the list to the proxy's address alone), and where to find that address: the remoteIP field of the http request log line. Loopback is not in the default. Model: opus-5-5	2026-10-02 00:41:36 +02:00
clawbot	507980a347	Bound username length at creation (closes #184) ... Usernames are limited to 1024 bytes, so no account can exist that is unable to log in. The username rides in the session cookie, which browsers and securecookie refuse past about 4 KB, leaving room for roughly 2000 bytes of username; the limit is about half that. User.BeforeSave returns ErrUsernameTooLong when a whole User is created or saved. A byte-counting check constraint on users.username catches every other write, including a column update. The limit appears in the constant and in the struct tag; a test fails if they disagree. Model: opus-5-5	2026-10-01 21:38:48 +02:00
clawbot	977fe87588	Verify login credentials before spending rate-limit budget (closes #150) ... In the shipped default, any stranger denied the operator the only administrative path at 5 requests per minute: TRUSTED_PROXIES is empty, the README requires a reverse proxy, so every login POST shared one bucket keyed on the proxy. Credentials are now verified first and only a FAILED attempt spends budget, so a correct password is never throttled. Failures are counted per (client bucket, submitted username), bounded. Concurrent Argon2id verifications are capped at two, and the queue for them at 16 — because verifying first lets an attacker force a 64 MB hash per request, and bounding the wait alone bounds nothing. The issue's own recommendation was insufficient and is rejected here: keying by username stops an attacker locking out a DIFFERENT account, but this is a single-admin product with a predictable bootstrap username, so flooding the operator's own name still locks them out. This is speculative — it implements a corrected recommendation ahead of the owner's ruling so the decision can be made by merging or reverting. Three things are disclosed rather than glossed: online guessing rises from 5/min to roughly 27/s, because the 429 is a label on the response and not a gate in front of the hash; the residual exposure is a loss of login AVAILABILITY, not latency, and a determined flood still denies login while it runs, at ~400x the cost and clearing the moment it stops; and the endpoint should be provisioned for ~400 MB resident, not the 203 MB of live commitment it itemises. Independently reviewed four times. Reviewers disproved the suspected FIFO starvation by measurement, then caught two successive memory bounds the code did not have — the second by parking waiters and reading the heap rather than checking the arithmetic.	2026-08-18 01:55:41 +02:00