Five wrong passwords from anyone lock a Player out of sign-in #436

New issue

Closed

opened 2026-10-15 22:24:07 +00:00 by root · 6 comments

root commented

2026-10-15 22:24:07 +00:00

(Migrated from gitlab.core-project.space)

What happens

Anyone can lock a Player out of sign-in. signInFailuresPerEmail allows 5 failures per 15 minutes per email (apps/api/src/config/config.ts:24), counted for every caller (apps/api/src/auth/auth.controller.ts:127-136). Five wrong passwords from any address block the real owner, even from their own browser, for 15 minutes, and can be repeated indefinitely.

Done when

The per-email limit no longer blocks a sign-in from a caller that did not fail. Possible directions:

key the counter on email and IP together;
or, past the limit, slow sign-in down instead of refusing it.

The per-IP limit stays as it is. A test shows that failures from one IP do not refuse a correct password from another.

## What happens Anyone can lock a Player out of sign-in. `signInFailuresPerEmail` allows 5 failures per 15 minutes per email (`apps/api/src/config/config.ts:24`), counted for every caller (`apps/api/src/auth/auth.controller.ts:127-136`). Five wrong passwords from any address block the real owner, even from their own browser, for 15 minutes, and can be repeated indefinitely. ## Done when The per-email limit no longer blocks a sign-in from a caller that did not fail. Possible directions: - key the counter on email and IP together; - or, past the limit, slow sign-in down instead of refusing it. The per-IP limit stays as it is. A test shows that failures from one IP do not refuse a correct password from another.

root commented

2026-10-15 22:41:05 +00:00

(Migrated from gitlab.core-project.space)

mentioned in commit 9373cb6f93

mentioned in commit 9373cb6f9399ed3817b228b1e557a47c966e5a82

root commented

2026-10-15 22:41:05 +00:00

(Migrated from gitlab.core-project.space)

mentioned in commit 0e535dbce6

mentioned in commit 0e535dbce64e68971eeead6fac16ecbe6d5998a1

root commented

2026-10-15 22:41:17 +00:00