✨ feat(auth): implement email-change verification, password security, signIn failures rate limiting #100
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…malization & policy checks - Switched all password fields to `SecretString` to avoid keeping raw passwords in memory. - Added `NormalizedPassword` with NFC normalization, invisible-char filtering, Unicode-safe length checks, and zeroizing storage. - Enforced password policy: ≥10 graphemes and zxcvbn score ≥4. - Updated hashing and verification to use normalized passwords; removed old byte-based validation logic. - Expanded test coverage for normalization, strength rules, hashing/verification, and verification codes. - Added new dependencies (`secrecy`, `zxcvbn`, `unicode-segmentation`, etc.) and updated Cargo.toml/Cargo.lock.
- Add sign-in rate limiting in `AuthService` using per-IP and per-user thresholds and time windows, returning generic credential errors on failure. - Normalize and reuse trimmed email in sign-up/sign-in flows and improve verification email logging. - Extend `users` table with `locked_until` and `fail_count_since` fields to support account lockout tracking. - Enhance `sign_in_attempts` schema with `target`, `INET` IP, `user_agent` and scoped indexes for IP/user-based throttling. - Update `AuthRepository` trait and `PgAuthRepository` to record sign-in attempts, check per-IP blocking, and decide when to lock accounts. - Update `UserRepository` trait and `PgUserRepository` to persist lockout state and track when failure counting starts.
|
Hey @xBLACKICEx 👋 Thank you for your pull request! 🙏 The team will review it shortly. In the meantime, here are a few projects you might find interesting: PR Statistics
Thanks again for contributing — we appreciate it! 🙌 |
Collaborator
|
Merged! |
xBLACKICEx
changed the title
xBLACKICEx
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR includes three focused security improvements based on the latest three commits:
1. Email change request & confirmation
2. Password security hardening
SecretStringto avoid storing raw passwords in memory.NormalizedPasswordwith:zxcvbnstrength score ≥ 43. Sign-in attempt tracking, throttling & account lockout
locked_untilandfail_count_sinceto theuserstable.sign_in_attemptsschema withip,user_agent,target, and optimized indexes.sign_inflow to:These changes complete the email-change verification feature and significantly strengthen password and login security.
Issue number
#98
Type of Change
Testing
Checklist