Depot PCs behind one address hit the per-address limit at shift change

Project: Engineering
Type: Bug
Status: Done Done
Priority: Highest
Organization: Brakeline
Reporter: Hanna Virtanen <hanna.virtanen@acme-hq.example>
Assignee: Jonas Berg <jonas.berg@acme-hq.example>
Labels: brakelinesecuritysign-in
Components: identity-service
Fix versions: identity-service 2026.09.10
Sprint: Sprint 50
Parent: ENG-1702 Sign-in lockout and rate limits
Created: 9 Sep 2026, 09:20 UTC
Updated: 16 Sep 2026, 08:45 UTC
Resolved: 10 Sep 2026, 06:30 UTC

Description

Testing with Brakeline's numbers before release: Leeds' depot PCs share one public address. At the 06:00 shift change about 60 people sign in within 3 minutes; a few typos and the whole depot gets 429s.

Steps to reproduce

Staging, per-address limit 20 attempts a minute.
From one address: 60 sign-ins in 3 minutes, 5 with a wrong password.

Expected: everyone with the right password gets in. Actual: sign-ins refused after the first minute.

Fix

Count only failed attempts towards the per-address limit. Successful sign-ins don't count.

Linked issues

relates to ENG-1824 Count only failed sign-ins per address, so a depot's shared PCs aren't locked out at shift start Done

Comments (3)

Jonas Berg · 9 Sep 2026, 14:40 UTC

Changed to failed attempts only. Mira agreed: the attack was all failures.

Hanna Virtanen · 10 Sep 2026, 06:30 UTC

Verified with the 60-person script before the release: all in.

Jonas Berg · 16 Sep 2026, 08:45 UTC

Follow-up on 16 Sep: the per-address limit raised for depot networks (OPS-43).