diff options
| -rw-r--r-- | routes/users.ts | 19 |
1 files changed, 17 insertions, 2 deletions
diff --git a/routes/users.ts b/routes/users.ts index 20afc5d8..438452b2 100644 --- a/routes/users.ts +++ b/routes/users.ts @@ -68,11 +68,26 @@ const verifyRecaptcha = async (response, req?) => { response, remoteip: ip, }, + // Bound the wait so a slow/unreachable Google can't hang the login. + timeout: { request: 6000 }, }) .json(); + // A real verdict from Google: fail CLOSED only when the captcha itself is + // invalid (success === false). return success || (!!config.adminpass && response === config.adminpass); - } catch { - return false; + } catch (e) { + // Fail OPEN on an INFRASTRUCTURE error (network blip, timeout, Google 5xx). + // Reaching Google is not part of authentication; failing closed here turned + // a transient coinos<->Google connectivity hiccup into a login outage — + // users got "failed captcha" until it cleared (2026-08-25 incident). The + // password and the per-IP login rate limits (ipCount>30 / ipFailures>20 -> + // 429) still gate the request; captcha is only bot-mitigation, so allowing + // it through when the verifier is unreachable is the safer failure mode. + warn( + "recaptcha verify unreachable — allowing login (fail-open)", + (e as any)?.code ?? (e as any)?.message ?? String(e), + ); + return true; } }; |