4 commits

Author	SHA1	Message	Date
유창욱	238b932c86	fix(cloud): add per-IP rate limit to /login before Argon2id verify (H2) ... Every login attempt, including unknown users (via DUMMY_HASH), forces a full Argon2id verify with no rate limit, letting a flood take down the login endpoint / shared host via hashing-cost amplification. Add a pre-auth per-IP limiter (RateLimiterRepository, default 20/min) as the first check in AuthController::login, before any user lookup or password hashing.	2026-07-12 09:11:47 +09:00
유창욱	902bbe93c8	fix(cloud): reset lockout on window expiry + constant-time unknown-user path (anti-enumeration)	2026-07-12 00:39:19 +09:00
유창욱	450c88978f	fix(cloud): session-id regeneration on login (fixation) + pristine test output	2026-07-12 00:35:41 +09:00
유창욱	b345a89788	feat(cloud): session store + auth controller with lockout	2026-07-12 00:28:18 +09:00