Add IP-based rate limiting on failed login attempts

[flightlesstux]

Problem

The /auth/login endpoint had no throttling mechanism. An attacker could issue unlimited POST requests against the GPG authentication endpoint with no server-side consequence, enabling:

• Brute-force enumeration of valid user fingerprints (FAILURE_IDENTITY_NOT_FOUND reveals existence)
• Repeated credential replay attempts against known accounts
• Resource exhaustion on the GPG keyring operations

Implementation

Uses CakePHP's built-in Cache to track failed attempts per client IP with a sliding window:

private const LOGIN_MAX_ATTEMPTS = 10;
private const LOGIN_ATTEMPT_WINDOW = 300; // 5 minutes

Flow:

1. On each POST /auth/login, read the attempt counter for the client IP from cache
2. If >= 10, return HTTP 429 immediately before any auth processing
3. On FAILURE_IDENTITY_NOT_FOUND or FAILURE_CREDENTIALS_INVALID, increment the counter (TTL = 300s)
4. On successful authentication, delete the counter for that IP

Cache key: auth_fail_ + sha1(clientIp) — normalises IPv6 addresses and prevents cache key injection via crafted IP strings.

What does NOT increment the counter

FAILURE_CREDENTIALS_MISSING (HTTP 200) is the first stage of the GPG two-step handshake and is a normal protocol step, not a failed authentication. It is intentionally excluded from the counter.

Impact

• Limits each IP to 10 failed attempts per 5-minute window
• No impact on normal usage patterns
• Successful logins are not throttled and clear the failure counter

[CLAassistant]

All committers have signed the CLA.