Security (medium): no login throttling issue #221 closed: completed andymccall opened this · 0 comments
andymccall set labels security, feature ·
closed by change aa0bfbd11f02 ·
andymccall set labels security, feature ·
closed by change aa0bfbd11f02 ·
External review: failed logins are audited but not slowed. Per-IP, per-account and global limits with exponential backoff and a short lockout (sign-in, 2FA codes, password reset, device sign-in and token-protected API alike), a clear message, an audit entry; Cloudflare rate limiting as defence in depth; encourage or require TOTP for administrators.