agatha
7a835d3172
After LOGIN_MAX_FAILURES consecutive failed attempts from the same source IP within LOGIN_WINDOW_SECONDS, POST /api/v1/auth/token returns HTTP 429 with a Retry-After header for LOGIN_COOLDOWN_SECONDS. A successful login resets the counter. Trusted upstream proxy IPs/CIDRs can be declared via LOGIN_TRUSTED_PROXY_IPS so X-Forwarded-For is honoured correctly behind nginx ingress or similar reverse proxies. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
35 lines
1.1 KiB
Markdown
35 lines
1.1 KiB
Markdown
# Specification Quality Checklist: Login Brute-Force Protection
|
|
|
|
**Purpose**: Validate specification completeness and quality before proceeding to planning
|
|
**Created**: 2026-05-06
|
|
**Feature**: [spec.md](../spec.md)
|
|
|
|
## Content Quality
|
|
|
|
- [X] No implementation details (languages, frameworks, APIs)
|
|
- [X] Focused on user value and business needs
|
|
- [X] Written for non-technical stakeholders
|
|
- [X] All mandatory sections completed
|
|
|
|
## Requirement Completeness
|
|
|
|
- [X] No [NEEDS CLARIFICATION] markers remain
|
|
- [X] Requirements are testable and unambiguous
|
|
- [X] Success criteria are measurable
|
|
- [X] Success criteria are technology-agnostic (no implementation details)
|
|
- [X] All acceptance scenarios are defined
|
|
- [X] Edge cases are identified
|
|
- [X] Scope is clearly bounded
|
|
- [X] Dependencies and assumptions identified
|
|
|
|
## Feature Readiness
|
|
|
|
- [X] All functional requirements have clear acceptance criteria
|
|
- [X] User scenarios cover primary flows
|
|
- [X] Feature meets measurable outcomes defined in Success Criteria
|
|
- [X] No implementation details leak into specification
|
|
|
|
## Notes
|
|
|
|
- All items pass. Spec is ready for `/speckit-plan`.
|