nullrouten0 and Claude Opus 5.5
a6f49e2b63
Limit wrong passwords on the room browser
...
POST /api/room checked the room password on every request with no failure
limit, and a browser may send a new identity token each time. Any host that
reached WebConfig could guess the room admin password, which is also the
radio and /api/login admin password, at main-loop speed.
One budget now covers all browser tokens, with /api/login's numbers: at most
five distinct wrong passwords in each thirty-second window. After that, a
request carrying a password is refused without checking it until the window
ends. Wrong passwords count in read-only rooms too. Empty passwords are never
counted or refused, so public read-only access keeps working. The last four
wrong passwords are remembered by 8-byte SHA-256 digest and not counted
again, so a tab still polling with an old or mistyped password cannot use up
the budget. Successful sign-ins do not refund failures. Radio login is
unchanged.
test_room_web_service.py gains PASSWORD_LIMIT, which runs the real
processRoomRequest: refusal after five failures from five tokens; identical
replies for wrong, guest and admin passwords while refused, with no password
check (calls to authorizeRoomLogin are counted); no lock extension from 300
refused requests; the 29999/30000 ms boundary and the first window after
boot; read-only and empty-password cases; no refund on success; repeated,
rotating and read-only stale passwords; slow distinct failures ageing out;
and a guard that the digest ring stays in bounds. It fails on the previous
processRoomRequest at the sixth guess.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-18 03:57:09 +00:00
..
2026-10-17 13:21:05 -07:00
2026-10-16 00:53:06 -07:00
2026-10-16 10:32:27 -07:00
2026-10-10 01:25:08 -07:00
2026-10-16 01:19:09 -07:00
2026-10-03 14:45:57 -07:00
2026-10-10 19:24:42 -07:00
2026-10-04 15:57:10 -07:00
2026-10-04 14:57:15 -07:00
2026-10-08 14:41:16 -07:00
2026-10-15 23:02:05 -07:00
2026-10-16 13:45:48 -07:00
2026-10-07 05:22:54 -07:00
2026-10-16 13:45:48 -07:00
2026-10-02 15:52:23 -07:00
2026-10-02 15:52:23 -07:00
2026-10-03 23:22:34 -07:00
2026-10-16 11:34:51 -07:00
2026-10-16 10:59:11 -07:00
2026-10-03 21:28:24 -07:00
2026-10-16 05:20:39 -07:00
2026-10-10 19:24:42 -07:00
2026-10-13 01:02:30 -07:00
2026-10-16 09:16:25 -07:00
2026-10-16 08:28:45 -07:00
2026-10-16 05:03:34 -07:00
2026-10-16 10:59:11 -07:00
2026-10-04 11:50:12 -07:00
2026-10-16 07:03:45 -07:00
2026-10-16 08:28:45 -07:00
2026-10-16 08:28:45 -07:00
2026-10-04 11:50:12 -07:00
2026-10-10 20:08:58 -07:00
2026-09-04 08:34:34 -07:00
2026-10-05 05:33:09 -07:00
2026-10-03 16:12:32 -07:00
2026-10-06 09:40:28 -07:00
2026-10-15 11:05:21 -07:00
2026-10-05 13:08:55 -07:00
2026-10-05 12:59:37 -07:00
2026-10-04 23:36:54 -07:00
2026-10-16 10:27:05 -07:00
2026-10-16 20:35:11 -07:00
2026-09-08 16:02:16 -07:00
2026-10-15 11:05:00 -07:00
2026-09-29 14:37:27 -07:00
2026-10-02 15:52:23 -07:00
2026-10-02 15:52:23 -07:00
2026-10-14 00:21:04 -07:00
2026-10-03 16:12:32 -07:00
2026-10-04 14:57:15 -07:00
2026-10-05 20:11:10 -07:00
2026-10-10 11:27:39 -07:00
2026-10-17 11:21:48 -07:00
2026-10-02 15:52:23 -07:00
2026-10-10 01:25:08 -07:00
2026-10-15 11:05:21 -07:00
2026-10-16 17:33:13 -07:00
2026-10-16 01:18:26 -07:00
2026-10-10 01:25:08 -07:00
2026-09-15 14:32:40 -07:00
2026-09-15 15:15:45 -07:00
2026-10-16 02:23:03 -07:00
2026-10-16 05:30:17 -07:00
2026-10-09 19:56:08 -07:00
2026-10-17 14:45:33 -07:00
2026-10-16 18:44:16 -07:00
2026-10-16 15:00:23 -07:00
2026-10-16 02:23:03 -07:00
2026-10-16 11:56:00 -07:00
2026-09-03 23:58:32 -07:00
2026-10-13 01:24:39 -07:00
2026-09-03 23:58:32 -07:00
2026-09-15 14:32:40 -07:00
2026-10-09 23:44:00 -07:00
2026-10-09 23:44:00 -07:00
2026-10-16 04:27:59 -07:00
2026-10-10 18:26:13 -07:00
2026-10-18 03:57:09 +00:00
2026-10-15 21:05:23 -07:00
2026-10-17 01:15:54 -07:00
2026-10-16 16:08:33 -07:00
2026-10-10 19:48:17 -07:00
2026-10-16 05:03:22 -07:00
2026-10-16 03:14:37 -07:00
2026-10-13 17:03:10 -07:00
2026-10-15 11:05:21 -07:00
2026-09-08 14:23:39 -07:00
2026-10-08 13:53:31 -07:00
2026-10-14 00:21:23 -07:00
2026-09-21 15:35:46 -07:00
2026-10-02 17:52:12 -07:00
2026-10-03 18:34:12 -07:00
2026-10-16 10:27:05 -07:00
2026-10-15 22:30:37 -07:00
2026-10-16 19:25:15 -07:00
2026-10-03 19:11:15 -07:00
2026-10-15 11:04:07 -07:00
2026-10-06 17:14:48 -07:00
2026-10-16 17:04:33 -07:00
2026-10-16 13:45:48 -07:00
2026-10-13 16:24:34 -07:00
2026-10-09 00:46:50 -07:00
2026-10-16 03:01:34 -07:00
2026-10-15 23:16:27 -07:00
2026-10-15 23:39:05 -07:00
2026-10-17 15:56:43 -07:00
2026-10-16 19:00:45 -07:00
2026-10-17 01:15:54 -07:00
2026-10-09 19:56:08 -07:00
2026-09-13 12:51:12 -07:00
2026-09-29 17:35:54 -07:00
2026-10-16 16:43:54 -07:00
2026-10-15 22:30:37 -07:00
2026-10-04 23:36:54 -07:00
2026-10-04 21:40:43 -07:00
2026-10-16 19:00:45 -07:00
2026-10-16 16:54:08 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 03:02:52 -07:00
2026-10-17 13:39:47 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 05:25:07 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 05:25:07 -07:00
2026-10-13 03:02:52 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 05:25:07 -07:00
2026-10-13 01:51:27 -07:00
2026-10-13 05:25:07 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 01:24:39 -07:00
2026-10-10 01:25:08 -07:00
2026-10-14 10:34:40 -07:00
2026-10-15 11:04:07 -07:00
2026-10-10 01:25:08 -07:00
2026-10-10 01:30:09 -07:00
2026-10-06 13:18:38 -07:00
2026-10-17 11:06:10 -07:00
2026-10-16 15:50:38 -07:00
2026-10-16 00:01:28 -07:00
2026-10-16 00:01:28 -07:00
2026-10-15 17:37:53 -07:00
2026-10-17 02:22:26 -07:00
2026-10-17 02:22:26 -07:00
2026-10-17 02:22:26 -07:00
2026-10-03 14:45:57 -07:00
2026-10-16 15:00:23 -07:00
2026-10-16 15:43:32 -07:00
2026-10-16 00:54:49 -07:00
2026-10-17 15:35:34 -07:00
2026-10-17 01:15:54 -07:00
2026-10-17 01:15:54 -07:00
2026-10-17 10:18:14 -07:00
2026-10-16 19:48:34 -07:00
2026-10-15 23:34:34 -07:00
2026-10-16 15:09:46 -07:00
2026-10-15 22:30:37 -07:00
2026-10-16 12:54:36 -07:00
2026-10-16 17:21:44 -07:00
2026-10-10 11:51:00 -07:00
2026-10-13 01:24:39 -07:00
2026-10-17 01:15:54 -07:00
2026-10-13 01:24:39 -07:00
2026-10-13 01:24:39 -07:00
2026-10-16 18:37:24 -07:00
2026-10-16 18:37:24 -07:00
2026-10-17 11:21:48 -07:00
2026-10-17 02:25:37 -07:00
2026-10-16 19:00:45 -07:00
2026-10-16 05:26:29 -07:00
2026-10-10 20:08:58 -07:00
2026-10-16 19:00:45 -07:00
2026-10-12 14:57:01 -07:00
2026-10-12 14:57:01 -07:00
2026-10-12 14:57:01 -07:00
2026-10-12 14:57:01 -07:00
2026-10-12 14:57:01 -07:00
2026-10-07 02:07:06 -07:00
2026-10-06 19:28:10 -07:00
2026-10-07 02:07:06 -07:00
2026-10-15 23:07:37 -07:00
2026-10-13 09:55:32 -07:00