Ilker ManapandClaude Opus 5.5 44cd58005a Count sign-in attempts per address and client, guard the sign-in form with a token, ration both forms per address ...

A wrong password from anywhere counted against the address, so ten locked
its owner out. Attempts are now counted per address and client, with a
looser bound per address alone. The sign-in form carries a token matched
by a cookie (login CSRF). POST /login and /signup are rationed per client
address, a hash waits at most ten seconds for a turn, and server init
writes signup_open: false.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-04 10:26:29 +02:00

..

accounting_test.go

Stop calling the PostgreSQL store SQLite, and stop guessing where it is

2026-09-27 12:20:40 +02:00

auth_test.go

Stop calling the PostgreSQL store SQLite, and stop guessing where it is

2026-09-27 12:20:40 +02:00

fallback_context_test.go

Stop calling the PostgreSQL store SQLite, and stop guessing where it is

2026-09-27 12:20:40 +02:00

harness_test.go

Add approximate prefix routing, and find out it did nothing

2026-09-16 12:13:19 +02:00

health_test.go

Give two control planes a shared address, and a probe that means something

2026-09-27 07:52:54 +02:00

ondemand_test.go

Drive on-demand loading end to end, not just per component

2026-09-17 17:52:49 +02:00

phase1_test.go

Phase 1: the router serves traffic

2026-09-16 01:41:13 +02:00

phase3_test.go

Let the catalog change while the cluster is running

2026-09-17 01:08:21 +02:00

phase15_test.go

Phase 1.5: admission control

2026-09-16 01:53:38 +02:00

prefix_test.go

Add approximate prefix routing, and find out it did nothing

2026-09-16 12:13:19 +02:00

signup_test.go

Count sign-in attempts per address and client, guard the sign-in form with a token, ration both forms per address

2026-10-04 10:26:29 +02:00

threads_test.go

Stop calling the PostgreSQL store SQLite, and stop guessing where it is

2026-09-27 12:20:40 +02:00