76a9cb8042
The next oCIS release is 9.0.0, so all envvars that were annotated with the previously planned 8.3.0 introduction version need to be updated. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
storage-publiclink
Brute Force Protection
The brute force protection will prevent access to public links if wrong passwords are entered. The implementation is very similar to a rate limiter, but taking into account only wrong password attempts.
This feature is enabled by default with predefined settings.
If you want to disable this feature, set the related configuration values to 0.
By default, you're allowed a maximum of 5 failed attempts in 1 hour:
STORAGE_PUBLICLINK_BRUTEFORCE_MAXATTEMPTS=5STORAGE_PUBLICLINK_BRUTEFORCE_TIMEGAP=1h
You can adjust those values to your liking in order to define the failure rate threshold (5 failures per hour, by default).
If the failure rate threshold is exceeded, the public link will be blocked
until such rate goes below the threshold. This means that it will remain
blocked for an undefined time: a couple of seconds in the best case, or up
to STORAGE_PUBLICLINK_BRUTEFORCE_TIMEGAP in the worst case.
If the public link is blocked by the brute force protection, it will be blocked for all the users. Any attempt with a false password will restart the trigger.
Note that this feature uses the configurable store. No setting changes need to be made when using defaults.