Skip to content

v1.4.546

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Oct 05:49
· 24 commits to main since this release
v1.4.546
33329a4

Changes

PR #2288 by pcbeingused333 and ksylvan: fix(server): lock out a client after repeated wrong API keys

  • Added rate limiting that locks out a client address for one minute after 10 invalid API keys within a minute, returning HTTP 429 with a Retry-After header for all subsequent requests, including those with a valid key.
  • Excluded requests with missing API keys from the failure count, since they are not treated as guesses.
  • Bounded the table of tracked clients to prevent unlimited memory growth.
  • Improved pruning of authentication failures by removing all unlocked clients while preserving active lockouts.
  • Simplified the authentication limit tests with directly controlled clock values and numeric client identifiers.
Assets 11
Loading