sockeye

Go to file

John Cardinal cd3ebed68b case 4681 - rate limits on the anonymous trial and licence routes, stricter email check, cryptographic codes

Anonymous trial requests could be sent without limit, each one emailing a
verification link to any address (bounces from made-up domains), and the
verification and v7 fetch codes came from System.Random (AyaNova security
review F40).
- ASP.NET Core rate limiter per client address: trial requests (rvr,
  subscription-server-trial-request) 5 per hour; verify, rvf and the legacy v7
  fetch 30 per 10 minutes; 429 over the limit. Runs after routing and after
  forwarded headers.
- rvr: the email must be a valid address (MailAddress) before anything is
  stored or sent.
- GenFetchCode: RandomNumberGenerator, same 10-letter format.
rvf is unchanged (still one-shot): repeatable fetch needs an AyaNova-side change
for older servers and is a separate later case.

Checked on the local server with invalid addresses only (no email sent, no
request stored): 6th trial request 429, 31st fetch 429, auth unaffected.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-24 12:54:59 -07:00

.vscode

case 4670 updated all packages, unit tests resign works all green, booted and generated v7 and v8 keys that were then consumed without error in the v8 and v7 test clients, everything license related seems ok at this point, will do more testing of other things updated

2026-09-25 13:19:01 -07:00

dist/assets/linux-server

2022-12-16 06:01:56 +00:00

graphics

2022-12-29 22:21:59 +00:00

server

case 4681 - rate limits on the anonymous trial and licence routes, stricter email check, cryptographic codes

2026-10-24 12:54:59 -07:00

sockeye.tests