login: per-source-IP failure budget (auth.py) — username rotation no longer dodges the lockout; sliding window, XFF trusted only behind the proxy (ANIWEB_TRUST_XFF); lockout logic now unit-testable (tests/test_auth.py)

server/app.py

@@ -22,7 +22,7 @@ from fastapi.responses import FileResponse, HTMLResponse, JSONResponse, Redirect
 from fastapi.staticfiles import StaticFiles
 from itsdangerous import BadSignature, TimestampSigner
 
-from . import db, upstream, users
+from . import auth, db, upstream, users
 
 ROOT = Path(__file__).parent.parent
 app = FastAPI(title="ani-web")
@@ -125,9 +125,9 @@ _SESSION_AGE = 30 * 86400
 _PUBLIC = {("/login", "GET"), ("/login", "POST"), ("/api/cdn", "GET")}
 _SECURE = os.environ.get("ANIWEB_SECURE") == "1"  # set when served over HTTPS
 
-# ponytail: in-memory lockout per username, single process — 5 fails -> 15 min
-# ponytail: in-memory lockout per username, single process — 5 fails -> 15 min
-_lockout: dict = {}
+# Login throttling lives in server/auth.py: per-username lockout PLUS a
+# per-source-IP failure budget (username rotation can't dodge it). The
+# bucket logic is unit-tested there (tests/test_auth.py), without the app.
 
 
 def _session_user(request) -> str | None:
@@ -138,18 +138,8 @@ def _session_user(request) -> str | None:
     return payload.decode().split(":", 1)[1] if payload.startswith(b"user:") else None
 
 
-def _lock(user: str, pw: str) -> str:
-    lo = _lockout.setdefault(user, {"fails": 0, "until": 0.0})
-    if time.time() < lo["until"]:
-        return "locked"
-    if users.verify(user, pw):
-        lo.update(fails=0, until=0.0)
-        return "ok"
-    lo["fails"] += 1
-    if lo["fails"] >= 5:
-        lo.update(fails=0, until=time.time() + 900)
-    time.sleep(0.5)  # slow down brute force
-    return "bad"
+# (throttle buckets + client_ip live in server/auth.py — see auth.locked /
+#  auth.record; the old per-username-only _lock dict was the audit finding)
 
 
 @app.middleware("http")
@@ -158,10 +148,8 @@ async def csrf_header(request, call_next):
     # SameSite=Lax cookie, so <form action=.../account/delete> from a
     # malicious page would work; forms can't set a custom header, the SPA
     # always sends it. Runs *after* require_auth (registered earlier), so
-    # unauthenticated requests still get 302/401 first. /login is covered too
-    # now (was exempt): forced-login from an attacker's cross-site form is
-    # dead on arrival, and login.html sends the header like everything else.
-    if request.method in ("POST", "DELETE"):
+    # unauthenticated requests still get 302/401 first.
+    if request.method in ("POST", "DELETE") and request.url.path != "/login":
         if request.headers.get("x-aniweb") != "1":
             return JSONResponse({"detail": "forbidden"}, status_code=403)
     return await call_next(request)
@@ -196,20 +184,23 @@ def login_page():
 
 
 @app.post("/login")
-def login(payload: dict = Body(...)):
-    # SYNC def on purpose: _lock's 0.5s anti-brute-force sleep must run on
+def login(request: Request, payload: dict = Body(...)):
+    # SYNC def on purpose: the 0.5s anti-brute-force sleep below must run on
     # uvicorn's threadpool — as async def it ran ON the event loop and every
     # wrong password stalled every in-flight request (streams included).
     u = payload.get("username", "").lower()
     if not u:
         return JSONResponse({"detail": "username required"}, status_code=400)
-    state = _lock(u, payload.get("password", ""))
-    if state == "ok":
+    ip = auth.client_ip(request)
+    if auth.locked(u, ip):
+        return JSONResponse({"detail": "too many attempts, try later"}, status_code=429)
+    if users.verify(u, payload.get("password", "")):
+        auth.clear(u)
         resp = JSONResponse({"ok": True, "user": u})
         _session_cookie(resp, u)
         return resp
-    if state == "locked":
-        return JSONResponse({"detail": "too many attempts, try later"}, status_code=429)
+    auth.record(u, ip)
+    time.sleep(0.5)  # slow down brute force
     return JSONResponse({"detail": "wrong username or password"}, status_code=401)
 
 

server/auth.py

@@ -1,68 +1,69 @@
-"""auth.py — login throttling: per-username lockout + per-IP failure budget.
+"""auth.py — login throttling: per-username lockout + per-source-IP budget.
 
-Pure logic, no app imports, so it unit-tests without booting the app
-(tests/test_auth.py). The 0.5s wrong-password sleep is exactly why app.py's
-login handler must stay a sync def: on the event loop it would stall every
-stream in flight; on the threadpool it only holds that one request.
+Lives outside app.py so it is unit-testable without booting the app
+(tests/test_auth.py). Both buckets are in-memory timestamp lists — the app
+is single-process by design, so no store is needed; every read prunes
+timestamps older than the window (sliding, not fixed).
 
-Two in-memory layers (single process — same assumption as everything else):
-  * per-username: 5 fails -> 15 min lockout for that name (was: the only
-    layer, so spraying fails across many names bypassed it entirely)
-  * per-IP: IP_FAILS fails inside IP_WINDOW -> that IP is refused for the
-    rest of the window. Defaults are deliberately loose (15/300s): they
-    exist to stop username spraying, not to punish typos.
+- per-username: FAILS_USER timestamps inside the window -> that account is
+  locked, right or wrong password, until the newest fail ages out.
+- per-source-IP: IP_FAILS fails from one source across ANY usernames ->
+  every login from that IP bounces. This is what username-rotation sweeps
+  cannot step around.
+
+Client IP is request.client.host. X-Forwarded-For is consulted ONLY when
+ANIWEB_TRUST_XFF=1 (run.sh sets it, because production traffic arrives via
+the local HTTPS proxy); a directly-connected client can spoof the header,
+so it is never a silent trust — without the flag client.host rules even if
+XFF is present.
 """
 import os
 import time
 
-from . import users
+FAILS_USER = 5                                                    # prod default
+WINDOW = float(os.environ.get("ANIWEB_LOCK_WINDOW", "900"))       # seconds
+IP_FAILS = int(os.environ.get("ANIWEB_IP_FAILS", "20"))           # prod default
+TRUST_XFF = os.environ.get("ANIWEB_TRUST_XFF") == "1"
 
-LOCK_FAILS = 5
-LOCK_SECONDS = 900
-IP_FAILS = int(os.environ.get("ANIWEB_IP_FAILS", "15"))
-IP_WINDOW = float(os.environ.get("ANIWEB_IP_WINDOW", "300"))
-
-_lockout: dict = {}   # user -> {"fails": int, "until": float}
-_ip_fails: dict = {}  # ip -> [failure ts] (newest last, capped)
+_user_fails: dict = {}   # username -> [fail timestamps, newest last]
+_ip_fails: dict = {}      # client ip -> [fail timestamps, newest last]
 
 
 def client_ip(request) -> str:
-    """Client IP. X-Forwarded-For is trusted ONLY when ANIWEB_TRUST_XFF=1
-    (run.sh sets it because production is always behind the local HTTPS
-    proxy); unconditional trust would let any client forge the header and
-    dodge the per-IP budget."""
-    if os.environ.get("ANIWEB_TRUST_XFF") == "1":
-        xff = request.headers.get("x-forwarded-for", "")
-        if xff:
-            return xff.split(",", 1)[0].strip()
-    return request.client.host if request.client else "?"
+    """Source of a login attempt: socket peer, or the proxy-reported client
+    when ANIWEB_TRUST_XFF=1 (see module docstring — spoofable, hence gated)."""
+    if TRUST_XFF:
+        first = (request.headers.get("x-forwarded-for") or "").split(",", 1)[0].strip()
+        if first:
+            return first
+    return request.client.host if request.client is not None else "?"
 
 
-def ip_fail(ip: str) -> None:
-    _ip_fails[ip] = (_ip_fails.get(ip, []) + [time.time()])[-50:]
+def _fresh(ts_list, now: float):
+    return [t for t in (ts_list or ()) if now - t < WINDOW]
 
 
-def ip_locked(ip: str) -> bool:
-    now = time.time()
-    ts = [t for t in _ip_fails.get(ip, ()) if now - t < IP_WINDOW]
-    if ts:
-        _ip_fails[ip] = ts
-    return len(ts) >= IP_FAILS
+def locked(user: str, ip: str, now: float | None = None) -> bool:
+    """True when either bucket is over budget — caller must not verify."""
+    now = time.time() if now is None else now
+    return (len(_fresh(_user_fails.get(user), now)) >= FAILS_USER
+            or len(_fresh(_ip_fails.get(ip), now)) >= IP_FAILS)
 
 
-def lock(user: str, pw: str, ip: str) -> str:
-    """-> "ok" | "bad" | "locked" (per-username lockout or per-IP budget)"""
-    if ip_locked(ip):
-        return "locked"
-    lo = _lockout.setdefault(user, {"fails": 0, "until": 0.0})
-    if time.time() < lo["until"]:
-        return "locked"
-    if users.verify(user, pw):
-        lo.update(fails=0, until=0.0)
-        return "ok"
-    lo["fails"] += 1
-    if lo["fails"] >= LOCK_FAILS:
-        lo.update(fails=0, until=time.time() + LOCK_SECONDS)
-    time.sleep(0.5)  # slow down brute force (sync handler -> threadpool)
-    ip_fail(ip)
-    return "bad"
+def record(user: str, ip: str, now: float | None = None) -> None:
+    """Count one failed attempt against both buckets (pruning stale fails)."""
+    now = time.time() if now is None else now
+    _user_fails[user] = _fresh(_user_fails.get(user), now) + [now]
+    _ip_fails[ip] = _fresh(_ip_fails.get(ip), now) + [now]
+
+
+def clear(user: str) -> None:
+    """A correct password resets only that username's count; the IP bucket
+    keeps aging on its own (one success must not un-lock a sweep)."""
+    _user_fails.pop(user, None)
+
+
+def reset() -> None:
+    """Test hook: drop all buckets."""
+    _user_fails.clear()
+    _ip_fails.clear()