Add honeypot field to login form: instant 24h IP ban on autofill

2026-09-12 00:40:29 +03:00
parent 2c7ec17c8b
commit d5359dd31f
3 changed files with 6 additions and 1 deletions
@@ -653,6 +653,10 @@ async function logAudit(req, action, target) {
 app.post('/api/auth/login', apiLimiter, async (req, res) => {
  const rawUsername = typeof req.body?.username === 'string' ? req.body.username.trim().toLowerCase() : '';
  const password = String(req.body?.password || '');
+  if (typeof req.body?.website === 'string' && req.body.website) {
+    await recordFailure(req, 'honeypot', 1, BAN_TTL_MS);
+    return res.status(401).json({ error: 'Неверный логин или пароль' });
+  }
  if (!rawUsername || rawUsername.length > 100 || !password) {
    return res.status(401).json({ error: 'Неверный логин или пароль' });
  }