reactbin/CLAUDE.md at 7a835d317211310abc4a96418dd1f91704cd9252

Files

agatha 7a835d3172 Feat: Rate-limit login endpoint to block brute-force attacks

After LOGIN_MAX_FAILURES consecutive failed attempts from the same source
IP within LOGIN_WINDOW_SECONDS, POST /api/v1/auth/token returns HTTP 429
with a Retry-After header for LOGIN_COOLDOWN_SECONDS. A successful login
resets the counter. Trusted upstream proxy IPs/CIDRs can be declared via
LOGIN_TRUSTED_PROXY_IPS so X-Forwarded-For is honoured correctly behind
nginx ingress or similar reverse proxies.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-06 21:01:37 +00:00

232 B

Raw Blame History

For additional context about technologies to be used, project structure, shell commands, and other important information, read the current plan at specs/009-login-rate-limiting/plan.md.

232 B Raw Blame History

232 B

Raw Blame History