fix(security): ship trusted-proxy ForwardedHeaders config for Traefik topologies + document lockout-DoS trade-off (plan R2-07 T3)

2026-07-13 10:42:37 -04:00
parent b532a1e30e
commit 24c2097ec3
6 changed files with 27 additions and 6 deletions
@@ -34,7 +34,7 @@ public class LoginThrottleTests
        for (var i = 0; i < 5; i++) throttle.RecordFailure("alice", "10.0.0.1");

        Assert.True(throttle.IsLockedOut("alice", "10.0.0.1"));
-        Assert.False(throttle.IsLockedOut("alice", "10.0.0.2"));  // per username+IP key
+        Assert.False(throttle.IsLockedOut("alice", "10.0.0.2"));  // per username+IP key — real isolation in production requires the trusted-proxy ForwardedHeaders config (R2 N2); without it all clients share the proxy IP
        Assert.False(throttle.IsLockedOut("bob", "10.0.0.1"));

        clock.Advance(TimeSpan.FromMinutes(6));                    // lockout window passed