From f534263c9c36704a43b64a31d0c8891a8376ca5a Mon Sep 17 00:00:00 2001 From: AdrianoDev Date: Sat, 25 Jul 2026 16:57:59 +0200 Subject: [PATCH] Rimuove il limite di tentativi dal login Co-Authored-By: Claude Fable 5 --- src/pages/admin/login.astro | 27 +++++++++++---------------- src/pages/login.astro | 23 +++++++++-------------- 2 files changed, 20 insertions(+), 30 deletions(-) diff --git a/src/pages/admin/login.astro b/src/pages/admin/login.astro index 259ae65..e42cc37 100644 --- a/src/pages/admin/login.astro +++ b/src/pages/admin/login.astro @@ -2,27 +2,22 @@ import Admin from '../../layouts/Admin.astro'; import { getDb } from '../../lib/db'; import { login, getSessionUser, landingFor, SESSION_COOKIE } from '../../lib/auth'; -import { rateLimit } from '../../lib/rate-limit'; export const prerender = false; let error = ''; if (Astro.request.method === 'POST') { - if (!rateLimit(`login:${Astro.clientAddress}`, 5, 15 * 60 * 1000)) { - error = 'Troppi tentativi: riprova tra 15 minuti.'; - } else { - const form = await Astro.request.formData(); - const token = login(getDb(), String(form.get('username') ?? ''), String(form.get('password') ?? '')); - if (token) { - Astro.cookies.set(SESSION_COOKIE, token, { - httpOnly: true, sameSite: 'lax', path: '/', - secure: import.meta.env.PROD, maxAge: 7 * 24 * 3600, - }); - // Ogni ruolo atterra sulla sua sezione: campus fuori dal pannello, gli - // altri sulla pagina admin che possono effettivamente aprire. - return Astro.redirect(landingFor(getSessionUser(getDb(), token)?.role ?? 'user')); - } - error = 'Credenziali non valide.'; + const form = await Astro.request.formData(); + const token = login(getDb(), String(form.get('username') ?? ''), String(form.get('password') ?? '')); + if (token) { + Astro.cookies.set(SESSION_COOKIE, token, { + httpOnly: true, sameSite: 'lax', path: '/', + secure: import.meta.env.PROD, maxAge: 7 * 24 * 3600, + }); + // Ogni ruolo atterra sulla sua sezione: campus fuori dal pannello, gli + // altri sulla pagina admin che possono effettivamente aprire. + return Astro.redirect(landingFor(getSessionUser(getDb(), token)?.role ?? 'user')); } + error = 'Credenziali non valide.'; } --- diff --git a/src/pages/login.astro b/src/pages/login.astro index 2009e39..f1eb963 100644 --- a/src/pages/login.astro +++ b/src/pages/login.astro @@ -2,7 +2,6 @@ import Base from '../layouts/Base.astro'; import { getDb } from '../lib/db'; import { login, getSessionUser, SESSION_COOKIE } from '../lib/auth'; -import { rateLimit } from '../lib/rate-limit'; import { safeNext } from '../lib/safe-next'; export const prerender = false; @@ -14,20 +13,16 @@ if (existing && getSessionUser(getDb(), existing)) return Astro.redirect(dest); let error = ''; if (Astro.request.method === 'POST') { - if (!rateLimit(`login:${Astro.clientAddress}`, 5, 15 * 60 * 1000)) { - error = 'Troppi tentativi: riprova tra 15 minuti.'; - } else { - const form = await Astro.request.formData(); - const token = login(getDb(), String(form.get('username') ?? ''), String(form.get('password') ?? '')); - if (token) { - Astro.cookies.set(SESSION_COOKIE, token, { - httpOnly: true, sameSite: 'lax', path: '/', - secure: import.meta.env.PROD, maxAge: 7 * 24 * 3600, - }); - return Astro.redirect(safeNext(String(form.get('next') ?? '') || dest)); - } - error = 'Credenziali non valide.'; + const form = await Astro.request.formData(); + const token = login(getDb(), String(form.get('username') ?? ''), String(form.get('password') ?? '')); + if (token) { + Astro.cookies.set(SESSION_COOKIE, token, { + httpOnly: true, sameSite: 'lax', path: '/', + secure: import.meta.env.PROD, maxAge: 7 * 24 * 3600, + }); + return Astro.redirect(safeNext(String(form.get('next') ?? '') || dest)); } + error = 'Credenziali non valide.'; } ---