Linus Rath a2253982e5 fix: limit wrong passwords tried through the login pre-check ...

`/api/auth/verify` checked any username and password against the JMAP
server without a limit. Every probe reaches the server from the
webmail's own address, so the route was a password oracle and enough
wrong passwords could trip Stalwart's authentication ban against the
webmail itself, locking out every user.

Wrong passwords now use up a budget of five per client and thirty
across all clients per fifteen minutes; right ones are refunded. Over
budget the route answers `inconclusive` and the browser probes the JMAP
server itself, as it did before the pre-check existed.

2026-09-26 16:36:58 +02:00

..

route.ts

fix: limit wrong passwords tried through the login pre-check

2026-09-26 16:36:58 +02:00