Changes
PR #2288 by pcbeingused333 and ksylvan: fix(server): lock out a client after repeated wrong API keys
- Added rate limiting that locks out a client address for one minute after 10 invalid API keys within a minute, returning HTTP 429 with a
Retry-Afterheader for all subsequent requests, including those with a valid key. - Excluded requests with missing API keys from the failure count, since they are not treated as guesses.
- Bounded the table of tracked clients to prevent unlimited memory growth.
- Improved pruning of authentication failures by removing all unlocked clients while preserving active lockouts.
- Simplified the authentication limit tests with directly controlled clock values and numeric client identifiers.