fix(security): audit batch A — validation, rate limiting, sessions (#20)

2026-07-02 03:22:17 +02:00
parent 2056548702
commit c5c33f7023
10 changed files with 500 additions and 2 deletions
@@ -5,10 +5,12 @@ using Microsoft.AspNetCore.Authentication.Cookies;
 using Microsoft.AspNetCore.Authentication.Google;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.RateLimiting;

 namespace InboxIntel.Api.Controllers;

 [ApiController]
+[EnableRateLimiting("auth")]  // AUDIT H-2: throttle login/challenge attempts per IP
 [ApiVersion("1.0")]
 [Route("api/v{version:apiVersion}/[controller]")]
 public class AuthController : ControllerBase