[H1] No rate-limit/lockout on the login path #15

New Issue

azcomputerguru · 2026-06-05T17:35:23-07:00

azcomputerguru commented

2026-06-05 17:35:23 -07:00

Severity: High

Component(s): server

Affected file(s):

server/src/api/auth.rs

Problem:
The login path has no rate-limiting or lockout, while machine-enroll already has elaborate protection.

Recommended fix:
Reuse the enroll rate-limiter keyed on (username.lower(), client_ip) and return 429 after a threshold.

Remediation phase: P0

From the 2026-06-05 three-way review (Claude+Gemini+Grok) — see reports/review-2026-06-05/SYNTHESIS-three-way.md (finding H1) and REMEDIATION-PLAN.md (P0).

**Severity:** High **Component(s):** server **Affected file(s):** - `server/src/api/auth.rs` **Problem:** The login path has no rate-limiting or lockout, while machine-enroll already has elaborate protection. **Recommended fix:** Reuse the enroll rate-limiter keyed on `(username.lower(), client_ip)` and return 429 after a threshold. **Remediation phase:** P0 From the 2026-06-05 three-way review (Claude+Gemini+Grok) — see reports/review-2026-06-05/SYNTHESIS-three-way.md (finding H1) and REMEDIATION-PLAN.md (P0).

azcomputerguru added the severity:high component:server security labels 2026-06-05 17:35:23 -07:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: azcomputerguru/guru-connect#15