kolaente 62f3e2f76b fix(ratelimit): give session renewal its own budget ...

The refresh-token and OAuth token endpoints shared the 10 requests/minute
floor that protects login, register and password reset. Access tokens live
for 10 minutes, so every client renews its session several times an hour --
and behind a reverse proxy `service.ipextractionmethod` defaults to `direct`,
which keys all of them to the proxy's address. Routine renewals therefore
used up the login budget, and users got "Too many requests" when signing in.
This hit the desktop app hardest: it exchanges its authorization code on the
very same endpoint it refreshes tokens on.

Renewal now has a separate limiter with its own `ratelimit.tokenrefreshlimit`
setting, defaulting to 60 requests/minute. Both limits stay enforced.

2026-08-18 14:01:06 +02:00

..

config_test.go

fix(config): apply deprecated service.jwtsecret to service.secret

2026-07-26 15:59:40 +00:00

config.go

fix(ratelimit): give session renewal its own budget

2026-08-18 14:01:06 +02:00