Same as AyaNova: failed logins counted in memory, 10 per login name or 50
per client address within 15 minutes, then 429 for the rest of the window.
Sockeye's login is public (only SSH to the droplet is limited).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Anonymous trial requests could be sent without limit, each one emailing a
verification link to any address (bounces from made-up domains), and the
verification and v7 fetch codes came from System.Random (AyaNova security
review F40).
- ASP.NET Core rate limiter per client address: trial requests (rvr,
subscription-server-trial-request) 5 per hour; verify, rvf and the legacy v7
fetch 30 per 10 minutes; 429 over the limit. Runs after routing and after
forwarded headers.
- rvr: the email must be a valid address (MailAddress) before anything is
stored or sent.
- GenFetchCode: RandomNumberGenerator, same 10-letter format.
rvf is unchanged (still one-shot): repeatable fetch needs an AyaNova-side change
for older servers and is a separate later case.
Checked on the local server with invalid addresses only (no email sent, no
request stored): 6th trial request 429, 31st fetch 429, auth unaffected.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Same fix as AyaNova (raven 141bdeb8): the 2FA step matched the user by temp
token alone and the token was left empty after a 2FA login, so an empty or
missing token skipped the password step. Now an empty or missing temp token is
refused, the token is cleared to null after success, and after 5 wrong codes
the password must be entered again.
Checked on the local server with a temporary user (removed afterwards): no or
empty temp token 401; normal sign in 200; 5 wrong codes then the right code 401;
new password entry 200.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
sockeye.tests retargeted to net10.0, packages current. Re-sign harness: 1399/1399.
AV0014 suppressed: licence controllers were never versioned under 5.x defaults.
