a620906209/CFDivePlatform
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security(auth): P2 帳號鎖定 + OAuth state 驗證 #23

Merged
a620906209 merged 1 commits from security/auth-p2-lockout-oauth-state into master 2026-06-02 17:39:03 +00:00
Conversation 0 Commits 1 Files Changed 14
+680 -47
a620906209 commented 2026-06-02 17:38:57 +00:00
Owner
Copy Link
Copy Source
  • Account lockout：連續失敗 5 次鎖定 15 分鐘（Fixed Window，Cache）
    • Member / Provider 各自獨立 namespace
    • Email 正規化（strtolower+trim）
    • 不存在帳號不累計計數（防 Cache 污染）
    • companion key 記錄 locked_until（ISO 8601）
  • OAuth CSRF 防護：移除 stateless()，手動 state 生成與驗證
    • session('oauth_state') + session('state') 雙寫確保 Socialite 內建驗證通過
    • state mismatch redirect 至 /login?error=oauth_failed
  • throttle 從 5,1 調整為 10,1，避免 IP throttle 在 lockout 前觸發
  • NormalizesEmail Trait、config/auth_lockout.php

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

- Account lockout：連續失敗 5 次鎖定 15 分鐘（Fixed Window，Cache） - Member / Provider 各自獨立 namespace - Email 正規化（strtolower+trim） - 不存在帳號不累計計數（防 Cache 污染） - companion key 記錄 locked_until（ISO 8601） - OAuth CSRF 防護：移除 stateless()，手動 state 生成與驗證 - session('oauth_state') + session('state') 雙寫確保 Socialite 內建驗證通過 - state mismatch redirect 至 /login?error=oauth_failed - throttle 從 5,1 調整為 10,1，避免 IP throttle 在 lockout 前觸發 - NormalizesEmail Trait、config/auth_lockout.php Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
a620906209 added 1 commit 2026-06-02 17:38:58 +00:00
security(auth): P2 帳號鎖定 + OAuth state 驗證 2a0e9255ae 
- Account lockout：連續失敗 5 次鎖定 15 分鐘（Fixed Window，Cache）
  - Member / Provider 各自獨立 namespace
  - Email 正規化（strtolower+trim）
  - 不存在帳號不累計計數（防 Cache 污染）
  - companion key 記錄 locked_until（ISO 8601）
- OAuth CSRF 防護：移除 stateless()，手動 state 生成與驗證
  - session('oauth_state') + session('state') 雙寫確保 Socialite 內建驗證通過
  - state mismatch redirect 至 /login?error=oauth_failed
- throttle 從 5,1 調整為 10,1，避免 IP throttle 在 lockout 前觸發
- NormalizesEmail Trait、config/auth_lockout.php

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
a620906209 merged commit b06d8524db into master 2026-06-02 17:39:03 +00:00
a620906209 deleted branch security/auth-p2-lockout-oauth-state 2026-06-02 17:39:03 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
a620906209
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: a620906209/CFDivePlatform#23
Delete Branch "security/auth-p2-lockout-oauth-state"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?