From 97fef182ce674e7858d7bd5dd5acf396dcd4abec Mon Sep 17 00:00:00 2001 From: shamoon <4887959+shamoon@users.noreply.github.com> Date: Fri, 7 Aug 2026 08:17:19 -0700 Subject: [PATCH] Update index.md --- docs/installation/index.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/docs/installation/index.md b/docs/installation/index.md index e747afc4d..68fb5a8e0 100644 --- a/docs/installation/index.md +++ b/docs/installation/index.md @@ -57,9 +57,7 @@ For password-only login: !!! warning - Homepage does not apply application-level rate limiting to password attempts. Deployments exposed outside a trusted network should configure their reverse proxy or ingress to rate limit POST requests to `/api/auth/callback/credentials`. - - Each failed attempt is logged at `warn` level as ` Failed password sign-in attempt`, which can be used as a fail2ban or CrowdSec filter. Note that a failed and a successful sign-in are both a `302` response, so a reverse proxy access log alone cannot distinguish them. No client address is recorded in this message: `X-Forwarded-For` is caller-supplied and a ban rule keyed on it could be tricked into blocking arbitrary addresses. Correlate the log timestamp with your reverse proxy's access log to identify the source. + Homepage does not apply application-level rate limiting to password attempts. Deployments exposed outside a trusted network should configure their reverse proxy or ingress to rate limit POST requests to `/api/auth/callback/credentials`. Each failed attempt is logged at `warn` level as ` Failed password sign-in attempt`, which can be used as a fail2ban or CrowdSec filter. For OIDC login (overrides password login):