From 05943dad70ce17ff61b8c0352abeec0964ca14f0 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 15:39:06 +0000 Subject: login: logins by key capped per user Review 6: a node remembers the challenges used until they expire, 10 000 at most, and refused every login by key once full. One user holding a key could make 10 000 logins within five minutes and keep everyone else out. A user may now log in by key at most --key-logins-per-user times (100) on a node within a challenge's lifetime, past which that user waits and others don't; the 10 000 stay as the cap for all users together. The lifetime, five minutes until now, is --challenge-lifetime. --- src/state/mod.rs | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'src/state') diff --git a/src/state/mod.rs b/src/state/mod.rs index 87b7fe7..4fcf413 100644 --- a/src/state/mod.rs +++ b/src/state/mod.rs @@ -157,6 +157,10 @@ pub(crate) struct AppState { pub(crate) challenges: Arc>, pub(crate) token_lifetime: Duration, pub(crate) session_lifetime: Duration, + /// How long a challenge to log in by key is valid, and how many logins by key a user + /// may make within it (`access::challenge`). + pub(crate) challenge_lifetime: Duration, + pub(crate) key_logins_per_user: usize, /// Origins whose pages may call this node's open endpoints (`api::cors`). pub(crate) cors_origins: Arc>, /// This node's own files, and how much it read and wrote them. -- cgit v1.3.1