The management API's authentication routes have no per-IP request throttle. /auth/login is protected by per-account lockout after repeated failures, but an attacker can still spread attempts across many usernames from one IP, or hammer other /auth/* routes, without hitting any IP-level ceiling. The public registration route that previously widened this surface has been removed (#1316), so the remaining exposure is login and the token/refresh endpoints.
Add lightweight per-IP throttling (sliding window, configurable threshold, 429 on breach) in front of the /api/v1/auth/* group, keeping the existing account-lockout behavior as a second layer. Ensure the limiter is safe behind the documented management-network proxy setup (trusted-proxy / real-IP resolution) so it throttles the true client, not the proxy.
Follow-up from #1316 / GHSA-3gc6-295r-xm5m.
The management API's authentication routes have no per-IP request throttle.
/auth/loginis protected by per-account lockout after repeated failures, but an attacker can still spread attempts across many usernames from one IP, or hammer other/auth/*routes, without hitting any IP-level ceiling. The public registration route that previously widened this surface has been removed (#1316), so the remaining exposure is login and the token/refresh endpoints.Add lightweight per-IP throttling (sliding window, configurable threshold,
429on breach) in front of the/api/v1/auth/*group, keeping the existing account-lockout behavior as a second layer. Ensure the limiter is safe behind the documented management-network proxy setup (trusted-proxy / real-IP resolution) so it throttles the true client, not the proxy.Follow-up from #1316 / GHSA-3gc6-295r-xm5m.