[MEDIUM][Security] In-Memory User Store Without Password Complexity or Brute-Force Protection

[filthyrake]

Summary

The create_user method in JWTAuthManager accepts any password without complexity validation. Combined with the in-memory user store (no account lockout, no failed attempt tracking), this makes brute-force attacks more feasible.

Affected Files

• truenas-mcp/src/auth.py (lines 496-524)

Impact

• Weak passwords could be easily guessed
• No protection against brute-force attacks
• No rate limiting to authentication endpoints

Recommended Fix

1. Add password complexity validation (minimum length, character diversity)
2. Implement account lockout after N failed attempts
3. Add rate limiting to authentication endpoints
4. Consider using an external identity provider for production

References

• CWE-521 (Weak Password Requirements)
• CWE-307 (Improper Restriction of Excessive Authentication Attempts)

🤖 Generated with Claude Code