security: add IP rate limiting + account lockout on auth endpoints

- Rate limit login (5/min), register (3/hr), refresh (10/min) per IP
- Account lockout after 5 consecutive failed logins (15 min cooldown)
- Fix stored XSS in admin panel (escapeHtml on all user-controlled data)
- All limits configurable via OXICLOUD_RATE_LIMIT_* / OXICLOUD_LOCKOUT_* env vars
- Zero new dependencies (uses existing moka crate for in-memory caches)
- Includes unit tests for lockout service

This commit is contained in:

Dionisio

2026-03-03 01:44:39 +01:00

parent d2c08d31ba

commit 1df52fd702

11 changed files with 558 additions and 17 deletions

									
										src/interfaces/middleware/mod.rs
									
		+1
		
												View File
												
				@@ -1,2 +1,3 @@

				pub mod auth;

				pub mod csrf;

				pub mod rate_limit;