Summary
No protection against brute-force password attacks. Rate limiting failed login attempts per username and per IP would improve security.
What to do
- Create
src/Security/LoginRateLimiter.cs
- Track failed attempts per username and per IP using a sliding window
- After N failures (configurable, default 5) in M minutes (default 15), temporarily block the username/IP
- Return 429 Too Many Requests with Retry-After header
Files to reference
src/Grants/PasswordGrantHandler.cs - login endpointsrc/Configuration/AuthServerOptions.cs - configuration
Important security feature - good way to understand the auth flow.
Summary
No protection against brute-force password attacks. Rate limiting failed login attempts per username and per IP would improve security.
What to do
src/Security/LoginRateLimiter.csFiles to reference
src/Grants/PasswordGrantHandler.cs- login endpointsrc/Configuration/AuthServerOptions.cs- configurationImportant security feature - good way to understand the auth flow.