mirror of
https://github.com/Sea-Haven-Industries/shoc-backend.git
synced 2026-10-05 00:12:13 +00:00
77a10e38ca
- Forgot Password is limited to 3 codes an hour and 10 a day per email, and an account gets 10 failed code checks a day across every code it is sent, so new client addresses and new codes no longer buy more guesses. Refused requests answer exactly like accepted ones. - The reset email is queued to a background sender, and unregistered addresses store a row no code can match, so both paths do the same work and return without waiting on the mail provider. Each request also clears expired codes. - Code hashes are HMAC-SHA256 under a key derived with HKDF from the JWT signing secret; rows in the previous unkeyed format stop matching. - Email and code are read only from the JSON body. |
||
|---|---|---|
| .. | ||
| .config | ||
| Controllers | ||
| DTOs | ||
| Filters | ||
| Helper | ||
| HostedServices | ||
| Infrastructure | ||
| Middleware | ||
| Models | ||
| Observability | ||
| Options | ||
| Properties | ||
| wwwroot | ||
| Api.SeaHavenIndustries.csproj | ||
| Api.SeaHavenIndustries.http | ||
| appsettings.Development.json | ||
| appsettings.json | ||
| appsettings.Production.json | ||
| aws-beanstalk-tools-defaults.json | ||
| db.txt | ||
| Program.cs | ||