Linus Rath 75bffd35e6 fix: limit pairing password attempts per mail account and per day ...

The step-up's failure count was keyed on the cookie slot, which the
client chooses, so a session could spread guesses over 50 slots; and
even one key allowed 480 failures a day, well above Stalwart's ban of
100 a day per address, which would ban the webmail's own IP for every
user. Failures now count per server and login name, 5 per 15 minutes
and 20 a day.

2026-09-27 04:49:03 +02:00

..

create

fix: limit pairing password attempts per mail account and per day

2026-09-27 04:49:03 +02:00

redeem

fix: link the mobile app from every account with a sign-in of its own

2026-09-27 04:16:18 +02:00

status

fix: link the mobile app from every account with a sign-in of its own

2026-09-27 04:16:18 +02:00

token

fix: link the mobile app from every account with a sign-in of its own

2026-09-27 04:16:18 +02:00