Admin9705 877816ab14 Implement recovery key rate limiting: 3 strikes = 15 minute lockout ...

- Added recovery_key_rate_limit table to track failed attempts by IP address
- Implemented 15-minute lockout after 3 failed recovery key attempts
- Rate limiting applies to both /auth/recovery-key/verify and /auth/recovery-key/reset endpoints
- Successful attempts clear the rate limiting for that IP
- Added cleanup of expired rate limit entries in database maintenance
- Enhanced logging with IP addresses for security monitoring
- Prevents brute force attacks on recovery keys while maintaining usability

2025-06-27 15:41:53 -04:00

..

lib

update

2025-04-12 18:58:01 -04:00

primary

Implement recovery key rate limiting: 3 strikes = 15 minute lockout

2025-06-27 15:41:53 -04:00

routes

more pushes

2025-04-26 15:04:57 -04:00