stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Throttle repeated operator sign-in failures #270

New Issue
Closed
opened 2026-08-08 06:10:04 +00:00 by timmy · 0 comments
timmy commented 2026-08-08 06:10:04 +00:00
Owner
Copy Link

Problem

Operator sign-in accepts unlimited invalid access-token attempts. A public client can repeatedly guess the privileged dashboard credential; responses never throttle or provide retry guidance. Existing session hardening (#258, #262, #268) does not address online guessing.

Vertical slice

Add a durable SQLite-backed, source-scoped sign-in limiter; enforce it before credential verification, clear failures after successful authentication, and make the mobile login form honor 429 Retry-After with a disabled countdown. Resolve forwarded client addresses only through explicitly configured trusted proxy CIDRs.

Acceptance tests

  • The configured failure budget returns generic 401 responses; the next attempt returns 429 with integer Retry-After and Cache-Control: no-store.
  • Attempts are shared across independent store instances and survive reconstruction.
  • Expired failures stop blocking and are pruned during later mutations.
  • A successful sign-in clears failures for that source.
  • Untrusted X-Forwarded-For is ignored; configured trusted proxies use the canonical forwarded client.
  • The login form disables submission for the server-provided interval without retaining or echoing the token.
  • Focused and full test suites pass.

Non-duplication evidence

Audited all 138 historical issue titles, 128 PRs/releases, and recent commits through 334fe77; no issue, release, or commit implements sign-in throttling, brute-force protection, or lockout.

## Problem Operator sign-in accepts unlimited invalid access-token attempts. A public client can repeatedly guess the privileged dashboard credential; responses never throttle or provide retry guidance. Existing session hardening (#258, #262, #268) does not address online guessing. ## Vertical slice Add a durable SQLite-backed, source-scoped sign-in limiter; enforce it before credential verification, clear failures after successful authentication, and make the mobile login form honor `429 Retry-After` with a disabled countdown. Resolve forwarded client addresses only through explicitly configured trusted proxy CIDRs. ## Acceptance tests - The configured failure budget returns generic 401 responses; the next attempt returns 429 with integer `Retry-After` and `Cache-Control: no-store`. - Attempts are shared across independent store instances and survive reconstruction. - Expired failures stop blocking and are pruned during later mutations. - A successful sign-in clears failures for that source. - Untrusted `X-Forwarded-For` is ignored; configured trusted proxies use the canonical forwarded client. - The login form disables submission for the server-provided interval without retaining or echoing the token. - Focused and full test suites pass. ## Non-duplication evidence Audited all 138 historical issue titles, 128 PRs/releases, and recent commits through `334fe77`; no issue, release, or commit implements sign-in throttling, brute-force protection, or lockout.
timmy self-assigned this 2026-08-08 06:10:04 +00:00
timmy closed this issue 2026-08-08 06:20:26 +00:00
timmy reopened this issue 2026-08-08 06:26:25 +00:00
timmy closed this issue 2026-08-08 06:27:18 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
timmy
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#270
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?