Anonymous trial requests could be sent without limit, each one emailing a
verification link to any address (bounces from made-up domains), and the
verification and v7 fetch codes came from System.Random (AyaNova security
review F40).
- ASP.NET Core rate limiter per client address: trial requests (rvr,
subscription-server-trial-request) 5 per hour; verify, rvf and the legacy v7
fetch 30 per 10 minutes; 429 over the limit. Runs after routing and after
forwarded headers.
- rvr: the email must be a valid address (MailAddress) before anything is
stored or sent.
- GenFetchCode: RandomNumberGenerator, same 10-letter format.
rvf is unchanged (still one-shot): repeatable fetch needs an AyaNova-side change
for older servers and is a separate later case.
Checked on the local server with invalid addresses only (no email sent, no
request stored): 6th trial request 429, 31st fetch 429, auth unaffected.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
sockeye.tests retargeted to net10.0, packages current. Re-sign harness: 1399/1399.
AV0014 suppressed: licence controllers were never versioned under 5.x defaults.
