umputun / cronn

74%

master: 75%

LAST BUILD ON BRANCH brute-force-protection

branch: brute-force-protection

CHANGE BRANCH

x

Reset

• brute-force-protection
• auth-implementation
• conditional-execution
• dependabot/github_actions/github-actions-updates-a2e7793ad6
• dependabot/go_modules/github.com/go-pkgz/lgr-0.12.0
• dependabot/go_modules/go-modules-updates-07f3a6036d
• dependabot/go_modules/go-modules-updates-24b9848b30
• dependabot/go_modules/go-modules-updates-5acbcdf0e0
• dependabot/go_modules/go-modules-updates-e08d9a54d9
• dependabot/go_modules/go-modules-updates-e7f7ae579a
• feat/alt-template-delimiters
• feat/filter-and-template-refactoring
• feat/run-now-button
• fix/web-parser-reuse-sqlite-locking
• gorelease
• improve-conditions-validation
• jitter-duration
• master
• paskal/clarify_email_notifications
• paskal/dependabot-disable-updates
• paskal/dependabot-security-updates
• paskal/fix_successful_notifications
• paskal/more_notifications
• paskal/notify
• paskal/update
• refs/tags/v0.2.0
• refs/tags/v0.3.0
• refs/tags/v0.3.1
• refs/tags/v0.4.0
• refs/tags/v1.0.0
• refs/tags/v1.1.0
• refs/tags/v1.1.1
• refs/tags/v1.2.0
• refs/tags/v1.3.0
• sighup
• site
• web-ui
• yaml-config-support

Build # 17219565338

Build Type

Pull #46

github

Committed by umputun

Commit Message

feat: add brute-force protection to login endpoint

Implement rate limiting for login attempts to prevent brute-force attacks as
recommended by Gemini security review.

Security improvements:
- Rate limit login attempts to 5 per minute per IP address using tollbooth
- Applied via middleware chain for clean architecture
- Custom error message for rate limit violations
- Comprehensive test coverage with 429 status code verification

Technical details:
- Added github.com/didip/tollbooth/v8 dependency
- Configured rate limiter: 5.0/60.0 requests per second with burst=5
- Applied to POST /login route via router.With() middleware
- Updated documentation with brute-force protection info

Test improvements:
- Added TestServer_LoginRateLimiting with rate limit verification
- Fixed HTTPS logout test with proper CSRF headers and unique IPs
- All authentication tests pass with 88.9% coverage

Addresses Gemini's #1 critical security recommendation while maintaining
clean code architecture and comprehensive test coverage.

Pull Request Pull Request #46: feat: add brute-force protection to login endpoint

Run Details

10 of 10 new or added lines in 2 files covered. (100.0%)

2112 of 2858 relevant lines covered (73.9%)

23.79 hits per line