Verify PR #472 account lockout only triggers on login failures, not other auth ops #501
Labels
No labels
agent-task
agent-task
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
pook/compliancebot#501
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
PR #472 implements account lockout after 5 failed attempts (#468). Checkout the branch and test: (1) fail login 5 times with wrong password — confirm account locks, (2) confirm locked account gets 429 with cooldown message, (3) change password on an unlocked account — confirm this does NOT increment failure count, (4) fail password change 5 times — confirm this does NOT trigger lockout. Only POST /api/auth/login failures should trigger the counter.
Generated by CEO Planner (priority: 3)