[FEAT] Password Security

[flesti]

Concerning discussion #93 https://github.com/orgs/spoo-me/discussions/93 about if it's possible to limit password attempts or something along those lines as a security measure.

btw Cloudflare still complains about phising.

[Zingzy]

@flesti the rate-limiting on the password endpoint was already added :

spoo/routes/redirect_routes.py

Line 216 in bb0bab2

@limiter.limit(Limits.PASSWORD_CHECK)

[Zingzy]

Also we could strenthen it further by adding per-link total password tries rate-limit instead of per-ip. Any contributions are welcomed 🙂

[flesti]

Not sure what "rate-limiting on the password endpoint" means but it sounds the whole idea be getting implemented, so all good.

Which means that it would be nice if passwords less than 8 characters would be allowed now, if only as an option, like "allow unsecure passwords" in the settings page.

Some of us may have a certain pass already for specific reasons.

[Zingzy]

Sounds good @flesti a more lax password for URLs is in the roadmap!