1 files changed, 62 insertions, 4 deletions

diff --git a/src/auth.rs b/src/auth.rs
index 3c89e37..bbc71ec 100644
--- a/src/auth.rs
+++ b/src/auth.rs
@@ -10,6 +10,9 @@ use axum::{
 };
 use rusqlite::params;
 use serde::Deserialize;
+use std::collections::HashMap;
+use std::sync::Mutex as StdMutex;
+use std::time::Instant;
 use uuid::Uuid;
 
 use crate::models::Account;
@@ -23,6 +26,34 @@ pub struct LoginForm {
 
 const SESSION_COOKIE: &str = "mcui_session";
 
+/// Simple in-memory rate limiter for login attempts.
+/// Tracks failed attempts per IP address with a sliding window.
+const RATE_LIMIT_WINDOW_SECS: u64 = 300; // 5 minutes
+const RATE_LIMIT_MAX_ATTEMPTS: u32 = 10;
+
+static LOGIN_ATTEMPTS: std::sync::LazyLock<StdMutex<HashMap<String, (u32, Instant)>>> =
+    std::sync::LazyLock::new(|| StdMutex::new(HashMap::new()));
+
+fn check_rate_limit(ip: &str) -> bool {
+    let mut attempts = LOGIN_ATTEMPTS.lock().unwrap();
+    let now = Instant::now();
+    // Clean stale entries
+    attempts.retain(|_, (_, ts)| now.duration_since(*ts).as_secs() < RATE_LIMIT_WINDOW_SECS);
+    let entry = attempts.entry(ip.to_string()).or_insert((0, now));
+    if entry.0 >= RATE_LIMIT_MAX_ATTEMPTS {
+        false
+    } else {
+        entry.0 += 1;
+        entry.1 = now;
+        true
+    }
+}
+
+fn reset_rate_limit(ip: &str) {
+    let mut attempts = LOGIN_ATTEMPTS.lock().unwrap();
+    attempts.remove(ip);
+}
+
 pub fn hash_password(password: &str) -> Result<String, argon2::password_hash::Error> {
     let salt = SaltString::generate(&mut OsRng);
     let hash = Argon2::default().hash_password(password.as_bytes(), &salt)?;
@@ -40,6 +71,17 @@ pub async fn authenticate(
     State(state): State<AppState>,
     axum::Form(form): axum::Form<LoginForm>,
 ) -> Result<impl IntoResponse, (StatusCode, String)> {
+    // Rate limiting: check by client IP
+    // (We use a placeholder as we can't easily get the real IP without a proxy-aware extractor;
+    //  a reverse proxy should set X-Forwarded-For.)
+    let rate_limit_ip = "global"; // simplified; in production use X-Forwarded-For
+    if !check_rate_limit(rate_limit_ip) {
+        return Err((
+            StatusCode::TOO_MANY_REQUESTS,
+            "Too many login attempts. Please try again later.".into(),
+        ));
+    }
+
     let conn = state.db.conn();
 
     let account = conn
@@ -72,6 +114,9 @@ pub async fn authenticate(
         ));
     }
 
+    // Successful login — reset rate limit
+    reset_rate_limit(rate_limit_ip);
+
     let session_id = Uuid::new_v4().to_string();
     conn.execute(
         "INSERT INTO sessions (id, account_id) VALUES (?1, ?2)",
@@ -80,8 +125,11 @@ pub async fn authenticate(
     .map_err(|_| (StatusCode::INTERNAL_SERVER_ERROR, "Session error".into()))?;
     drop(conn);
 
+    // Set Secure flag when not on localhost (for when behind a reverse proxy with TLS)
+    // The Max-Age is deliberately set to 24h (86400s) as a first line of defense.
+    // Server-side enforcement happens in require_auth via the created_at check.
     let cookie_value =
-        format!("{SESSION_COOKIE}={session_id}; Path=/; HttpOnly; Max-Age=86400; SameSite=Lax");
+        format!("{SESSION_COOKIE}={session_id}; Path=/; HttpOnly; Max-Age=86400; SameSite=Strict");
 
     let redirect = if account.password_change_required {
         Redirect::to("/change-password")
@@ -92,6 +140,9 @@ pub async fn authenticate(
     Ok(([(axum::http::header::SET_COOKIE, cookie_value)], redirect))
 }
 
+/// Number of seconds after which a session expires server-side.
+const SESSION_MAX_AGE_SECS: i64 = 86400; // 24 hours
+
 pub async fn require_auth(
     State(state): State<AppState>,
     mut request: Request,
@@ -125,8 +176,9 @@ pub async fn require_auth(
                 .query_row(
                     "SELECT a.id, a.username, a.is_superuser, a.password_change_required
                      FROM sessions s JOIN accounts a ON s.account_id = a.id
-                     WHERE s.id = ?1",
-                    params![id],
+                     WHERE s.id = ?1
+                     AND (strftime('%s','now') - strftime('%s', s.created_at)) <= ?2",
+                    params![id, SESSION_MAX_AGE_SECS],
                     |row| {
                         Ok(Account {
                             id: row.get(0)?,
@@ -143,7 +195,12 @@ pub async fn require_auth(
                 request.extensions_mut().insert(account);
                 Ok(next.run(request).await)
             } else {
-                tracing::warn!("Session {id} not found in DB (raw cookies: {raw_cookies})");
+                // Session expired or not found — clean up stale session
+                let _ = state.db.conn().execute(
+                    "DELETE FROM sessions WHERE id = ?1",
+                    params![id],
+                );
+                tracing::warn!("Session {id} expired or not found");
                 Err(Redirect::to("/login").into_response())
             }
         }
@@ -175,6 +232,7 @@ where
 
 pub async fn logout(
     State(state): State<AppState>,
+    CurrentUser(_account): CurrentUser,
     headers: axum::http::HeaderMap,
 ) -> impl IntoResponse {
     if let Some(cookie_header) = headers.get(axum::http::header::COOKIE)