Module rate_limit 

Throttle for the unauthenticated auth endpoints.

POST /auth/login verifies a password against a hash, so without this it is an unmetered online password oracle on a public site. The limiter keys on the resolved client address (see crate::client_ip) rather than on anything the request can choose.

Structs

AuthLimiter

Shared throttle state, built once at startup.

Functions

throttle_auth

Rejects auth requests from an address that has exceeded its window.

throttle_verification

Rejects requests from an address making more token verifications than any real client would.