Jean
61005f52f5
All checks were successful
CI / check (push) Successful in 3m46s
REGISTER was rate-limited but RESEND and RESETPASS weren't — anyone could repeatedly request confirmation/reset codes for any account with an address on file, flooding the victim's inbox and burning the service's sender reputation. A per-account 60s cooldown (code_issue_wait, mirroring the vhost request throttle) now gates both paths; guessing was already infeasible (2^40 code + 5-try limit), so this closes the abuse, not an auth hole. |
||
|---|---|---|
| .. | ||
| db | ||
| dispatch.rs | ||
| kicker.rs | ||
| mod.rs | ||
| register.rs | ||
| sasl.rs | ||
| scram.rs | ||
| service.rs | ||
| state.rs | ||
| tests.rs | ||