From d1a12bc0585aa583263362304218803ebf0afa9a Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Tue, 13 Oct 2026 07:52:33 -0700 Subject: login: drop the unused per-username failure counter The counter was incremented on every failed login and read but never acted on; the per-IP limits do the throttling. Its keys never expired and had grown to most of the keyspace. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01UjHzoBmW1iPpEe5qC2LDYB --- routes/users.ts | 7 ------- 1 file changed, 7 deletions(-) diff --git a/routes/users.ts b/routes/users.ts index 711ad07f..aa4e4b11 100644 --- a/routes/users.ts +++ b/routes/users.ts @@ -425,8 +425,6 @@ export default { username = username.toLowerCase().replace(/\s/g, ""); username = username.split("@")[0]; - const fk = `${username}:failures`; - const failures = await g(fk); const ipFailKey = `ip:${ip}:login:fail`; const ipFailures = await g(ipFailKey); if (!isAdmin && ipFailures > 20) return res.code(429).send({}); @@ -443,8 +441,6 @@ export default { if (!user || !verified) { await db.incrBy(ipFailKey, 1); if ((await db.ttl(ipFailKey)) < 0) await db.expire(ipFailKey, 600); - await db.incrBy(fk, 1); - setTimeout(() => db.decrBy(fk, 1), 120000); return res.code(401).send({}); } @@ -869,9 +865,6 @@ export default { await s(`user:${id}`, user); await db.del(`reset:${code}`); - const un = username.toLowerCase().replace(/\s/g, ""); - await db.del(`${un}:failures`); - res.send(pick(user, whitelist)); for await (const k of db.scanIterator({ MATCH: "ip:*:login:fail" })) { -- cgit v1.2.3