apunkt/SurfSense
1
0
Fork 0
mirror of https://github.com/MODSetter/SurfSense.git synced 2026-07-22 23:31:12 +02:00
Code Issues Projects Releases Packages Wiki Activity

refactor: update authentication error handling to prevent user enumeration and improve error messages

Browse source
This commit is contained in:
Anish Sarkar 2026-02-09 12:57:32 +05:30
parent 2add106296
commit c1016591da
3 changed files with 14 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

2
surfsense_backend/app/app.py
View file

@ -62,7 +62,7 @@ def _rate_limit_exceeded_handler(request: Request, exc: RateLimitExceeded):
# ============================================================================
# Stricter per-IP limits on auth endpoints to prevent:
# - Brute force password attacks
# - User enumeration via LOGIN_USER_NOT_FOUND / REGISTER_USER_ALREADY_EXISTS
# - User enumeration via REGISTER_USER_ALREADY_EXISTS
# - Email spam via forgot-password
#
# These use direct Redis INCR+EXPIRE for simplicity and reliability.