Wanjohi 304bb1f2ef fix(auth): count sign-in codes against the mailbox, not the browser ...

The cap on how many codes a sign-in could ask for was held per attempt,
keyed by a value in the caller's own cookie. That bounds nothing. The
caller decides how many attempts to start, and starting a fresh one costs
them a discarded cookie — so either replaying an older cookie or simply
beginning again walked straight around it, and the only thing left
spacing the mail out was the interval between sends.

The count now sits against the claim, over a window. That is the thing
being protected: the mailbox belongs to somebody who did not ask to hear
from us, and whoever is pointing at it is not the party to trust with the
tally.

A resend also left the previous code live, with a budget of guesses of
its own. Several resends therefore meant several working codes and
several times the chances at them, which made asking for a new code the
cheapest way to buy more tries at the old one. A new code now retires the
one before it.

Reported against the replay path. The replay was real and the same hole
was wider than that: starting a new attempt needed no replay at all.

2026-09-05 10:05:11 +03:00

..

auth

fix(auth): count sign-in codes against the mailbox, not the browser

2026-09-05 10:05:11 +03:00

core

fix(auth): make a device sign-in an answer somebody gave

2026-09-05 09:40:03 +03:00