Public authentication endpoints have no rate limiting, lockout, or anti-automation (CWE-307)

Status

Repository / Component

Plain-English Description

The login and related sign-in endpoints accept unlimited attempts with no throttling, temporary lockout, or bot protection. An attacker can automate high-volume guessing against accounts, limited only by how long each password check takes.

Description of the Underlying Issue

The router installs only a CSP header-setting middleware (http/http.go:30-35); no limiter or throttle is present. The login/signup/renew handlers are registered without any rate control (http/http.go:49-51), and loginHandler invokes auther.Auth per request with no attempt tracking, backoff, or lockout (http/auth.go:121-138). The missing anti-automation control (CWE-307) applies to the public authentication surface, primarily POST /api/login.

Potential Attack

An attacker scripts high-rate POST requests to /api/login (credential stuffing or targeted guessing against a known username). No per-IP or per-account counter, delay, or lockout intervenes; the server processes every attempt.

Outcomes of Potential Attack

The attacker can run online credential-stuffing and account-targeting attacks and consume auth-path CPU (each attempt triggers a bcrypt verification). Practical password brute-force is heavily blunted by bcrypt.DefaultCost and the 12-character minimum password length for login passwords, so the residual exposure is credential stuffing, targeting of weak/reused passwords, and auth-path resource consumption rather than fast offline-style cracking.

Affected Scope

Public auth endpoints POST /api/login (+ /signup, /renew) (http/http.go:49-51); loginHandler (http/auth.go:121-138)

Suggested Fix (plain english)

Add per-IP and per-account rate limiting or lockout in front of the login endpoint so automated guessing is throttled.

Suggested Fix (detailed)

Introduce per-IP and per-account rate limiting / exponential backoff (or account lockout after N failures) in front of loginHandler, implemented as router middleware alongside the existing CSP middleware (http/http.go:30-35) or inside http/auth.go:121-138. Verify by scripting rapid repeated failed logins and confirming attempts are throttled or temporarily locked. Related: DOK-100043 (same missing control on public share-password verification) and DOK-100050 (per-login subprocess fork amplifies the same public surface). Add per-IP and per-account rate limiting/backoff (or a lockout) in front of loginHandler.

Validation

The control is definitively absent and the endpoint is public; kept fully_valid but low, with bcrypt + 12-char minimum password noted as strong partial mitigations.

first_opinion

Full Evidence

http/http.go:30-35 the only router middleware is the CSP header setter; no limiter/throttle

http/http.go:49-51 login/signup/renew handlers registered with no rate control

http/auth.go:121-138 loginHandler invokes auther.Auth per request with no attempt tracking or lockout

Proven fact: There is no rate limiting, lockout, or anti-automation on the public authentication endpoints (CWE-307)

Unvalidated fact: Practical password brute-force is heavily mitigated by bcrypt.DefaultCost and MinimumPasswordLength=12 for login passwords; the residual exposure is credential stuffing, account-targeting, and auth-path resource consumption

Unvalidated fact: /api/renew requires an already-valid token and /api/signup requires Signup enabled, so the brute-force surface is primarily /api/login

http/http.go:30-35 — the only router middleware is the CSP header setter; no limiter/throttle

http/http.go:49-51 — login/signup/renew handlers registered with no rate control

http/auth.go:121-138 — loginHandler invokes auther.Auth per request with no attempt tracking or lockout

Proven fact: There is no rate limiting, lockout, or anti-automation on the public authentication endpoints (CWE-307).

Unvalidated fact: Practical password brute-force is heavily mitigated by bcrypt.DefaultCost and MinimumPasswordLength=12 for login passwords; the residual exposure is credential stuffing, account-targeting, and auth-path resource consumption.

Unvalidated fact: /api/renew requires an already-valid token and /api/signup requires Signup enabled, so the brute-force surface is primarily /api/login.

http/http.go:29-35 — only r.Use middleware is the CSP header setter; no limiter

http/http.go:49 — api.Handle("/login", monkey(loginHandler(tokenExpirationTime), "")) with no Methods()/throttle

http/auth.go:121-138 — loginHandler runs auther.Auth per request with no attempt tracking

grep across *.go for rate.?limit|throttl|limiter|tollbooth|ulule|MaxBytesReader — no functional matches

Mitigating context: users/password.go:27,33 (bcrypt.DefaultCost); settings/settings.go:15 (DefaultMinimumPasswordLength=12)