mirror of
https://github.com/HeyPuter/puter.git
synced 2026-09-16 02:05:36 +00:00
Daniel Salazar
5c8defb940
The only thing in front of the bcrypt compare on the DAV host was the 600/min request ceiling, keyed on a fingerprint that rotates with client-controlled headers. /login guards the same credential with a captcha and two much tighter buckets; DAV had neither, which left password and TOTP guessing viable from a host that answers any origin. The request ceiling can't double as a credential ceiling — a working DAV client resends its credentials on every request — so the new buckets count only verifications that failed: 10 per account and 50 per address per 15 minutes, sized like /login's. They're read before the compare, so an exhausted bucket costs no bcrypt round, and successful requests never draw them down. `-token` attempts are held by the address bucket alone; bucketing them per account would let bad tokens lock out good ones. Reading a bucket without spending from it is new, hence `peekRateLimit` and the matching `peek` on all three backends. Also documents the DAV limits, which were undisclosed.