mirror of
https://github.com/narrrl/narl-workspace.git
synced 2026-11-03 16:41:27 +01:00
nvrl
41d2d7ef77
The login endpoint answered guesses as fast as they arrived, against a single static password. Wrong attempts now back off — 1s, 2s, 4s, up to 30s — and a correct one clears the count. It is a single counter rather than a table keyed by address: there is only one account, so an attacker gains nothing by rotating source IPs, and there is no per-client map to grow. The cap is there so that someone hammering the login delays the owner by half a minute rather than locking them out. Wrong credentials now answer 401 rather than 400. The server also warns at startup if DIARY_PASSWORD is still the value from .env.example.