vh/homepage
1
0
Fork 0
mirror of https://github.com/gethomepage/homepage.git synced 2026-09-16 00:55:48 -07:00
Code Issues Actions 9 Packages Projects Releases Wiki Activity

Note lack of rate-limiting

Browse Source
This commit is contained in:
shamoon
2026-07-13 10:16:26 -07:00
parent 32e7036b8a
commit ffdb01513c
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/installation/index.md
+5 -1
View File
@@ -53,7 +53,11 @@ Use an `https://` URL for public or TLS-terminated deployments so authentication
For password-only login:
- `HOMEPAGE_AUTH_PASSWORD` (password-only login; required unless OIDC settings are provided)
- `HOMEPAGE_AUTH_PASSWORD` (a strong, unique password; required unless OIDC settings are provided)
!!! warning
Homepage does not apply application-level rate limiting to password attempts. Deployments exposed outside a trusted network should configure their reverse proxy or ingress to rate limit POST requests to `/api/auth/callback/credentials`.
For OIDC login (overrides password login):