feat(api): 账户资料与密码安全

2026-09-03 16:56:20 +08:00
parent 46d98ab11e
commit a5b89ddb1d
13 changed files with 552 additions and 14 deletions
@@ -47,6 +47,10 @@ AUTH_REGISTER_IP_LIMIT=5
 AUTH_REGISTER_EMAIL_LIMIT=3
 # Maximum refresh attempts per IP inside the window; refresh tokens have no trusted email before validation.
 AUTH_REFRESH_IP_LIMIT=30
+# 密码修改在同一限流窗口内允许的每 IP 最大次数。
+AUTH_CHANGE_PASSWORD_IP_LIMIT=10
+# 密码修改在同一限流窗口内允许的每已认证用户最大次数。
+AUTH_CHANGE_PASSWORD_USER_LIMIT=5

 # Comma-separated trusted reverse-proxy IPs/CIDRs. Keep empty for direct local access; never set to true.
 TRUSTED_PROXY_CIDRS=