John Cardinal d8be701bcd case 4726 - login lockout per login name and per address ...

Failed logins are counted in memory (util/LoginThrottle.cs): 10 per login
name or 50 per client address within 15 minutes, then attempts are refused
with 429 for the rest of the window without checking the password. A
correct password clears the login's count; loopback is not counted per
address. Each lockout is logged. F6 fixed (2FA part in case 4710).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-24 20:12:26 -07:00

35 KiB

Raw Blame History

View Raw