4 people c54ec52f0f fix(auth): limit failed TOTP attempts per account (#39993) ...

Gitea accepted unlimited wrong TOTP passcodes, so anyone holding an
account's password could enumerate the 6-digit code in minutes. This
allows 5 failed attempts per account, then refuses TOTP until 15 minutes
after the last one.

- The count lives in the cache, and the global lock spans the check,
validation and counting, so new sessions and concurrent requests cannot
widen it. With Redis, both are shared across instances
- Applies to every TOTP check: the web 2FA page, account recovery and
Basic auth with `X-Gitea-OTP` (API, git, packages)
- Only wrong or replayed passcodes count, server errors do not
- Scratch codes and WebAuthn stay usable as the recovery path while
locked
- Failures log `Failed authentication attempt for <user> from <ip>`,
which the fail2ban filter already matches

---------

Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

2026-11-07 23:01:49 +00:00

..

access_token_scope_test.go

feat: add commitstatus access token scope (#40144)

2026-11-01 06:27:12 +00:00

access_token_scope.go

refactor: remove duplicated and dead Go code (#40244)

2026-11-06 11:59:49 +00:00

access_token_test.go

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

access_token.go

feat: Add audit logging (#38189)

2026-09-12 08:15:23 +00:00

auth_token.go

fix(auth): avoid "compromised account" false-alarm when login with remember-me token (#39686)

2026-10-12 08:44:52 +00:00

main_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

oauth2_list.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

oauth2_test.go

test: speed up go tests (#39914)

2026-10-26 11:22:44 +00:00

oauth2.go

enhance: replace tea CLI with gt (#40036)

2026-11-01 12:47:10 +00:00

session.go

refactor!: move go-chi/session into Gitea (#39504)

2026-10-02 21:08:14 +02:00

source_test.go

refactor: remove UnmarshalHandleDoubleEncode patch and fix repo unit TODO (#39998)

2026-11-04 05:28:49 +00:00

source.go

refactor: remove UnmarshalHandleDoubleEncode patch and fix repo unit TODO (#39998)

2026-11-04 05:28:49 +00:00

token_cache.go

feat(user): Personal access tokens can be regenerated (#38907)

2026-08-17 18:17:16 +00:00

twofactor_test.go

fix(auth): limit failed TOTP attempts per account (#39993)

2026-11-07 23:01:49 +00:00

twofactor.go

fix(auth): limit failed TOTP attempts per account (#39993)

2026-11-07 23:01:49 +00:00

webauthn_test.go

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

webauthn.go

feat(user): allow renaming security keys (webauthn/passkey) (#39413)

2026-10-05 19:12:22 +02:00