lobo 5512453774 fix(login): same error for every failed login, block disabled users, rate limit ...

Unknown email, wrong password and disabled account now all return 401 INVALID_CREDENTIALS; unknown emails still run bcrypt against a dummy hash so timing does not leak them. After 5 failures per email or 20 per client IP, login returns 429 with Retry-After for 15 minutes. LoginRequest is now validated.

2026-09-24 10:22:30 +02:00

..

main

fix(login): same error for every failed login, block disabled users, rate limit

2026-09-24 10:22:30 +02:00

test/java/auth_service

fix(login): same error for every failed login, block disabled users, rate limit

2026-09-24 10:22:30 +02:00