feat: Harden login captcha gate by replacing request-body counter with server-side session counter (UserController::postLogin)

Author: matiasperrone-exo

app/Http/Controllers/UserController.php

@@ -396,8 +396,8 @@ public function postLogin()
     {
         $max_login_attempts_2_show_captcha = $this->server_configuration_service->getConfigValue("MaxFailed.LoginAttempts.2ShowCaptcha");
         $max_login_failed_attempts = intval($this->server_configuration_service->getConfigValue("MaxFailed.Login.Attempts"));
-        $login_attempts                    = 0;
-        $username                          = '';
+        $login_attempts = (int) Session::get('login_attempts', 0);
+        $username = '';
         $user = null;
 
         try
@@ -411,7 +411,6 @@ public function postLogin()
             if (isset($data['password']))
                 $data['password'] = trim($data['password']);
 
-            $login_attempts = intval(Request::input('login_attempts'));
             // Build the validation constraint set.
             $rules = [
                 'username' => 'required|email',
@@ -436,7 +435,10 @@ public function postLogin()
                 $connection = $data['connection'] ?? null;
 
                 try {
+                    $user = $this->auth_service->getUserByUsername($username);
                     if ($flow == "password" && $this->auth_service->login($username, $password, $remember)) {
+                        $user->setLoginFailedAttempt(0);
+                        Session::forget('login_attempts');
                         return $this->login_strategy->postLogin();
                     }
 
@@ -467,16 +469,20 @@ public function postLogin()
                         }
 
                         $otpClaim = OAuth2OTP::fromParams($username, $connection, $password);
+
                         $this->auth_service->loginWithOTP($otpClaim, $client);
+                        $user?->setLoginFailedAttempt(0);
+                        Session::forget('login_attempts');
                         return $this->login_strategy->postLogin();
                     }
                 } catch (AuthenticationException $ex) {
                     // failed login attempt...
 
-                    $user = $this->auth_service->getUserByUsername($username);
-                    if (!is_null($user)) {
-                        $login_attempts = $user->getLoginFailedAttempt();
-                    }
+                    $login_attempts = $user?->updateLoginFailedAttempt();
+                    Session::put('login_attempts', $login_attempts);
+
+                    // User.loginFailedAttempt drives account lockout (persisted by auth_service).
+                    // $login_attempts intentionally NOT overwritten; session counter drives captcha gate.
 
                     return $this->login_strategy->errorLogin
                     (
@@ -505,7 +511,7 @@ public function postLogin()
                 'validator'                         => $validator,
             ];
 
-            if (is_null($user) && isset($data['username'])) {
+            if (is_null($user) && !empty($data['username'])) {
                 $user = $this->auth_service->getUserByUsername($data['username']);
             }
 

resources/js/login/login.js

@@ -185,7 +185,6 @@ const PasswordInputForm = ({
             <input type="hidden" value={userNameValue} id="username" name="username"/>
             <input type="hidden" value={csrfToken} id="_token" name="_token"/>
             <input type="hidden" value="password" id="flow" name="flow"/>
-            <input type="hidden" value={loginAttempts} id="login_attempts" name="login_attempts"/>
             {shouldShowCaptcha() && captchaPublicKey &&
                 <Turnstile
                     className={styles.turnstile}
@@ -271,7 +270,6 @@ const OTPInputForm = ({
                 <input type="hidden" value="otp" id="flow" name="flow"/>
                 <input type="hidden" value={otpCode} id="password" name="password"/>
                 <input type="hidden" value="email" id="connection" name="connection"/>
-                <input type="hidden" value={loginAttempts} id="login_attempts" name="login_attempts"/>
                 {shouldShowCaptcha() && captchaPublicKey &&
                     <Turnstile
                         className={styles.turnstile}