Harden login: brute-force throttle, timing equalisation, first-run race by Tim020 · Pull Request #1460 · dreamteamprod/DigiScript

Tim020 · 2026-10-19T20:28:50Z

Summary

Failed logins are now throttled in memory per client address (20 free attempts) and per submitted username (5 free attempts), whether or not the username exists, with exponential lockout (30s doubling, capped at 15 min) answered with 429 and a Retry-After header. Successful login clears the username counter. Tables are size-bounded and decay; state lives on the app instance (injectable clock) so it is test/xdist safe.
Unknown usernames now run a bcrypt check against a dummy hash so response time does not reveal which accounts exist.
Login no longer holds a per-username lock across the bcrypt check; NamedLockRegistry now discards locks once idle so it cannot grow from user-supplied names.
Minimum password length raised from 6 to 8 (server validation, both client/ and client-v3/ validators and hints); admin-reset temporary passwords now use 4 words.
First-run / user creation (/api/v1/auth/create and /api/v2/users) runs under a single lock with the has-any-users check inside it, so concurrent first-run requests cannot create two admins. A one-time setup token was not added to keep this PR contained; the residual risk (anyone who can reach a fresh server first can claim the admin account) is documented in the getting-started docs.
Docs updated (getting started, user config).

Tests

New backend tests: throttle unit tests (fake clock), 429/Retry-After flow, unknown-user throttling, dummy-hash path, min length, 4-word temp passwords, concurrent first-run on both endpoints, lock pruning. Existing tests updated for the new minimum.
Playwright: added throttle and short-password checks to the auth spec; full chromium suite passes (227). Client lint/typecheck/vitest pass for both clients; ruff and full pytest pass.

🤖 Generated with Claude Code

… serialise first-run user creation - In-memory per-IP and per-username throttle with exponential lockout (429 + Retry-After) - Verify against a dummy bcrypt hash for unknown usernames - Login no longer holds a per-username lock; NamedLockRegistry prunes idle locks - Minimum password length 8 (server and both clients); temporary passwords use 4 words - First-run/user creation runs under one lock with the has-any-users check inside it - Tests, docs and E2E coverage Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

github-actions · 2026-10-19T20:29:26Z