Dionisio 1df52fd702 security: add IP rate limiting + account lockout on auth endpoints ...

- Rate limit login (5/min), register (3/hr), refresh (10/min) per IP
- Account lockout after 5 consecutive failed logins (15 min cooldown)
- Fix stored XSS in admin panel (escapeHtml on all user-controlled data)
- All limits configurable via OXICLOUD_RATE_LIMIT_* / OXICLOUD_LOCKOUT_* env vars
- Zero new dependencies (uses existing moka crate for in-memory caches)
- Includes unit tests for lockout service

2026-03-03 01:44:39 +01:00

..

app

feat(security): HttpOnly cookies + CSP headers + CSRF double-submit protection

2026-03-03 01:10:50 +01:00

core

feat(security): HttpOnly cookies + CSP headers + CSRF double-submit protection

2026-03-03 01:10:50 +01:00

features

feat(security): HttpOnly cookies + CSP headers + CSRF double-submit protection

2026-03-03 01:10:50 +01:00

views

security: add IP rate limiting + account lockout on auth endpoints

2026-03-03 01:44:39 +01:00