fix(api): harden sign-in throttling, OIDC authorization and auth state #2

2026-10-23T13:58:34Z

Zakaria commented

2026-10-23 13:58:34 +00:00

Key login throttling on the real peer address; read X-Forwarded-For only
from FLOCI_UI_TRUSTED_PROXIES (right-most untrusted hop). Add a per-IP
limit across usernames so one attacker can no longer lock out the admin.
Require an OIDC allow-list (FLOCI_UI_OIDC_ALLOWED_GROUPS / _EMAILS, or
FLOCI_UI_OIDC_ALLOW_ALL_USERS=true); fall back to UserInfo for groups
when the ID token omits them. Redirect IdP and token errors to /login
instead of returning 500s; cache discovery and JWKS.
Sweep expired sessions, attempts and pending OIDC requests every 60s,
cap each map, and throttle OIDC sign-in starts per IP.
Fix the .ts import extension that broke the API type-check.
Add auth.test.ts and document the new settings.

- Key login throttling on the real peer address; read X-Forwarded-For only from FLOCI_UI_TRUSTED_PROXIES (right-most untrusted hop). Add a per-IP limit across usernames so one attacker can no longer lock out the admin. - Require an OIDC allow-list (FLOCI_UI_OIDC_ALLOWED_GROUPS / _EMAILS, or FLOCI_UI_OIDC_ALLOW_ALL_USERS=true); fall back to UserInfo for groups when the ID token omits them. Redirect IdP and token errors to /login instead of returning 500s; cache discovery and JWKS. - Sweep expired sessions, attempts and pending OIDC requests every 60s, cap each map, and throttle OIDC sign-in starts per IP. - Fix the .ts import extension that broke the API type-check. - Add auth.test.ts and document the new settings.

Zakaria added 1 commit 2026-10-23 13:58:34 +00:00

fix(api): harden sign-in throttling, OIDC authorization and auth state 2db02ed369

- Key login throttling on the real peer address; read X-Forwarded-For only
  from FLOCI_UI_TRUSTED_PROXIES (right-most untrusted hop). Add a per-IP
  limit across usernames so one attacker can no longer lock out the admin.
- Require an OIDC allow-list (FLOCI_UI_OIDC_ALLOWED_GROUPS / _EMAILS, or
  FLOCI_UI_OIDC_ALLOW_ALL_USERS=true); fall back to UserInfo for groups
  when the ID token omits them. Redirect IdP and token errors to /login
  instead of returning 500s; cache discovery and JWKS.
- Sweep expired sessions, attempts and pending OIDC requests every 60s,
  cap each map, and throttle OIDC sign-in starts per IP.
- Fix the .ts import extension that broke the API type-check.
- Add auth.test.ts and document the new settings.

Zakaria closed this pull request

2026-10-23 14:00:18 +00:00

Zakaria self-assigned this 2026-10-23 14:00:59 +00:00

Zakaria reopened this pull request

2026-10-23 14:01:40 +00:00

Zakaria merged commit 502d0b3986 into main

2026-10-23 14:01:47 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Zakaria/floci-ui#2