golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(quick-261022-vfz): user-plugin /login throttle via surf.ClientIP and whole-second tokens_valid_after writers

Browse Source
This commit is contained in:
Jakub Zych
2026-10-22 23:08:04 +02:00
parent c309a1abe9
commit e9ebf93d36
6 changed files with 560 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
.planning/todos/pending/2026-10-22-user-login-lockout-and-same-second-cutoff.md
View File

@@ -33,6 +33,10 @@ Tests: X-Forwarded-For behind a trusted proxy is the `/login` throttle key; a re
Base is sm-user-plugin `4bf44fc` (G4). Hold push/tag for SummerCMS v0.5.0. After the commit, fill items 9 and 10 in `.planning/notes/2026-10-22-external-user-plugin-escalations.md` like G2–G4 (`done (unreleased)`, ships in v0.5.0). Leave the todo in pending with an Outcome.
## Outcome (2026-10-22)
Quick `261022-vfz`. Two fix commits on sm-user-plugin master, `b6f8055` and `a484d0e` (base `4bf44fc`). `b6f8055`: `/login` uses `surf.ClientIP(r, surf.TrustedProxies(appConfig(app)))` as `/register` does; the same `ip` feeds `RejectIfThrottled`, `refuseLogin` and `CheckAndRecordLogin`; exported `RemoteIP` is unchanged with a corrected doc comment; README updated; `TestLoginThrottleClientIP` (Docker) covers the trusted proxy and an ignored untrusted `X-Forwarded-For`. `a484d0e`: `/reset-password` (`tokens_valid_after` only; `email_verified_at` unchanged) and the admin password set truncate to the second; change-password and bouncer untouched; `TestPasswordCutoffSameSecond` (Docker) covers `iat` equal to the cutoff (accepted on `jwt.auth`, `/fetch` and `/refresh`) and one second earlier (refused). Reply note items 9 and 10 filled. Not tagged, not pushed: ships with the v0.5.0 wave.
## Invoke
```