Jakub Zych b6f8055c56 fix: /login throttles failed logins per client address behind trusted proxies (surf.ClientIP), like /register ...

Behind a reverse proxy every visitor had the proxy's RemoteAddr, so one client's failed logins locked the account for all. The throttle key is now surf.ClientIP with http.trusted_proxies, the expression /register uses; X-Forwarded-For from an untrusted peer is still ignored. RemoteIP is unchanged.

2026-10-22 22:53:29 +02:00

45 KiB

Raw Blame History

View Raw