This repository was archived by the owner on Oct 5, 2026. It is now read-only.
Repository navigation
This repository was archived by the owner on Oct 5, 2026. It is now read-only.
Rate limiting and lockout on password and magic-link endpoints #12
Description
Part of #1.
Blocked by: #5 (D1 schema: users, identities, credentials, sessions, single-use tokens, clients)
Problem. Password login is a credential-stuffing target and magic-link requests are a mail-bombing target. Both need limits keyed on more than the client IP.
Proposed approach. Through the harness RateLimiter port and rate_limit_keys helper:
- Password login: per IP (10 per minute), per normalized email (5 per 15 minutes regardless of IP), and a per-account lockout after 10 failures in an hour that requires a magic link or passkey to clear. Failed and successful attempts count identically toward the IP limit so success does not reveal anything.
- Magic-link request: per IP (5 per 10 minutes) and per email (3 per hour); the response is identical whether or not the email exists.
- Password registration and password change: per IP.
Captcharequired on password login and magic-link request when the port is present, andfz doctoralready refuses production without it.- All limits are configuration with the defaults above; responses are
429withRetry-After.
Acceptance criteria
- Each limit tested with the fake rate limiter; lockout tested with the sqlite adapter
- Identical response bodies for existing and unknown emails on every limited endpoint
- A locked account cannot log in with a correct password until cleared, and clearing is tested
- Limits documented with the reasoning for each number
Activity
Email and password: argon2id, a lockout, and answers that reveal noth…
ParallelEntrepreneur commentedon Sep 7, 2026
Most of this is shipped; leaving it open for the parts I could not verify.
Shipped (#42 for password, #43 for magic links):
cratefield_core::rate_limit_keys(ip, email)and answer429withRetry-Afterviacratefield_core::rate_limited(decision.retry_after)—auth-password/src/handlers.rs:97andauth-magic-link/src/handlers.rs:106.RateLimiterandCaptchaare declared optional ports on both modules, so a deployment without them degrades rather than fails.auth-password/src/lockout.rs, tested against the sqlite adapter.Not verified, and the reason this stays open:
RateLimiterport and its configuration, so this repository does not choose or test them.Either close this as delivered and open a smaller issue for the numbers, or keep it open until the harness side is pinned down. I did not want to close it on my own reading.