feat(security): add brute-force rate limiting to login and lost_password#452

Open

onovy wants to merge 8 commits into

redimp:mainfrom

onovy:fix/sec-09-brute-force-protection

Commits on Apr 9, 2026

feat(security): add Flask-Limiter dependency and ProxyFix support
onovy
committed
feat(security): add brute-force rate limiting to login and lost_password (decorators + handler)
onovy
committed
feat(security): add brute-force rate limiting tests and conftest fixture update
onovy
committed
feat(security): make rate limit thresholds configurable via RATELIMIT_LOGIN and RATELIMIT_LOST_PASSWORD
onovy
committed
fix(auth): render form directly with 429 status when rate limit is hit
onovy
committed
Merge branch 'main' into fix/sec-09-brute-force-protection
onovy
committed
fix(deps): Lock Flask-Limiter version
onovy
committed
chore(deps): bump Flask-Limiter from 3.12 to 4.1.1
onovy
committed