BaaRai
2419038884
fix(auth): rate-limit login per IP, 12-character passwords, loopback default
...
- POST /api/auth/login: 10 attempts per minute per TCP peer IP
(X-Forwarded-For ignored), then 429 with Retry-After. The block starts
at 1 minute and doubles on each attempt while blocked and on each new
block, capped at 15 minutes. A successful login clears the IP. No
per-account lockout. In-memory, idle entries swept after 15 minutes,
at most 10,000 IPs.
- New passwords (init, change-password, /setup page) need 12 characters.
Login does not check length, so existing 8-character passwords work.
- The binary's -addr default is 127.0.0.1:8787. The Docker image passes
-addr :8787 explicitly and is unchanged.
- GET /api/health returns {"ok":true} without a valid token; with one it
still returns service and version for the web UI top bar.
2026-11-05 16:48:27 +01:00
..
2026-10-12 06:45:21 +02:00
2026-10-12 06:45:21 +02:00
2026-07-26 04:27:45 -04:00
2026-10-12 00:58:53 +02:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-11-05 16:48:27 +01:00
2026-11-05 16:48:27 +01:00
2026-07-26 04:27:45 -04:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-08-28 14:03:07 +08:00
2026-10-08 23:14:34 +02:00
2026-09-10 16:06:08 +08:00
2026-10-23 18:12:38 -03:00
2026-10-21 15:08:37 +02:00
2026-10-12 08:53:20 +02:00
2026-09-29 10:09:23 -04:00
2026-10-08 23:14:34 +02:00
2026-10-21 15:00:16 +02:00
2026-08-31 09:00:21 -04:00
2026-10-08 23:14:34 +02:00
2026-08-24 19:28:18 +08:00
2026-10-08 23:14:34 +02:00
2026-10-21 15:00:16 +02:00
2026-11-03 23:47:49 +01:00
2026-11-03 22:14:35 +01:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-09-10 13:03:20 +08:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-10-21 14:46:56 +02:00
2026-10-21 14:46:56 +02:00
2026-10-08 23:14:34 +02:00
2026-08-24 19:29:00 +08:00
2026-10-08 23:14:34 +02:00
2026-10-12 18:43:41 +02:00
2026-08-24 19:29:00 +08:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-10-10 18:12:42 +02:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-10-21 14:25:35 +02:00
2026-10-21 14:25:35 +02:00
2026-11-03 23:25:47 +01:00
2026-11-02 17:03:57 +01:00
2026-10-12 08:54:29 +02:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-08-25 09:40:05 -04:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-11-05 16:48:27 +01:00
2026-11-05 16:48:27 +01:00
2026-10-08 23:14:34 +02:00
2026-08-24 19:29:00 +08:00
2026-08-24 19:29:00 +08:00
2026-10-21 15:00:16 +02:00
2026-10-11 22:50:00 +02:00
2026-10-11 22:50:00 +02:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-10-23 18:12:38 -03:00
2026-10-12 21:13:28 +02:00
2026-07-26 04:27:45 -04:00
2026-10-11 23:06:39 +02:00
2026-08-24 14:14:15 +08:00
2026-10-08 23:14:34 +02:00
2026-11-03 23:25:47 +01:00
2026-11-05 16:48:27 +01:00
2026-10-12 06:41:22 +02:00
2026-09-17 12:52:57 -04:00
2026-10-08 23:14:34 +02:00
2026-10-11 22:26:22 +02:00
2026-10-19 00:33:08 +02:00
2026-10-19 00:33:08 +02:00
2026-10-08 23:14:34 +02:00
2026-08-24 19:30:14 +08:00
2026-10-08 23:14:34 +02:00
2026-10-11 19:02:23 +02:00
2026-08-24 14:14:15 +08:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-08-28 12:56:29 +08:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-08-24 19:29:00 +08:00
2026-10-08 23:14:34 +02:00
2026-10-21 15:08:37 +02:00
2026-10-09 14:28:08 +02:00
2026-10-08 23:14:34 +02:00
2026-10-13 14:49:47 +02:00
2026-10-08 23:14:34 +02:00
2026-10-21 15:16:25 +02:00
2026-10-21 15:00:16 +02:00
2026-10-21 15:13:56 +02:00
2026-10-21 15:13:56 +02:00
2026-10-08 23:14:34 +02:00
2026-10-12 21:13:28 +02:00
2026-10-19 00:28:27 +02:00
2026-10-19 00:28:27 +02:00
2026-10-09 11:37:30 +02:00
2026-10-23 18:12:38 -03:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-10-12 18:43:29 +02:00
2026-08-25 12:05:26 +08:00
2026-08-25 12:05:26 +08:00
2026-07-26 04:27:45 -04:00
2026-10-11 14:53:08 +02:00
2026-10-11 14:53:08 +02:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-10-08 23:14:34 +02:00
2026-08-31 09:00:21 -04:00
2026-10-08 23:14:34 +02:00