diff options
| author | Adam Soltys <[email protected]> | 2026-08-25 22:30:35 -0700 |
|---|---|---|
| committer | Adam Soltys <[email protected]> | 2026-08-25 22:30:35 -0700 |
| commit | be1f54473273a97d5201948433a53216da26398f (patch) | |
| tree | 69efeb04022c3c1e8ddcadd3a79e48fd2faef542 /server.c | |
| parent | 13d906b4239e7520359df76943dece656e10e240 (diff) | |
| download | coinos-server-be1f54473273a97d5201948433a53216da26398f.tar.gz coinos-server-be1f54473273a97d5201948433a53216da26398f.zip | |
login: fail-open recaptcha verify on infrastructure errors
verifyRecaptcha failed closed on ANY error from the Google siteverify call, so
a transient coinos<->Google network blip (or a Google slowdown) turned every
non-admin login into a "failed captcha" 401 until connectivity recovered — a
self-inflicted login outage from an external dependency.
Distinguish a real verdict from an infrastructure failure: fail CLOSED only on
a genuine success:false from Google; on a thrown error (network, timeout, 5xx)
fail OPEN and log it. Reaching Google is not part of authentication — the
password and the per-IP login rate limits still gate the request, and captcha
is only bot-mitigation, so allowing a login through when the verifier is
unreachable is the safer failure mode. Also bound the call with a 6s timeout so
a slow verifier can't hang the login.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01XiwgmQKwKnRxUmVDd4xSf7
Diffstat (limited to 'server.c')
0 files changed, 0 insertions, 0 deletions