mirror of
https://github.com/Sea-Haven-Industries/shoc-backend.git
synced 2026-09-30 08:23:12 +00:00
77a10e38ca
- Forgot Password is limited to 3 codes an hour and 10 a day per email, and an account gets 10 failed code checks a day across every code it is sent, so new client addresses and new codes no longer buy more guesses. Refused requests answer exactly like accepted ones. - The reset email is queued to a background sender, and unregistered addresses store a row no code can match, so both paths do the same work and return without waiting on the mail provider. Each request also clears expired codes. - Code hashes are HMAC-SHA256 under a key derived with HKDF from the JWT signing secret; rows in the previous unkeyed format stop matching. - Email and code are read only from the JSON body.
13 lines
499 B
C#
13 lines
499 B
C#
namespace SeaHaven.Services.Interfaces
|
|
{
|
|
/// <summary>
|
|
/// Hands a password reset email to a background sender, so the request that asked
|
|
/// for it does not wait on the mail provider and cannot be timed against one that
|
|
/// sent nothing.
|
|
/// </summary>
|
|
public interface IPasswordResetEmailQueue
|
|
{
|
|
/// <summary>Returns false when the queue is full and the email was dropped.</summary>
|
|
bool TryEnqueue(string emailTo, string subject, string body);
|
|
}
|
|
}
|