enum

KemalIdentity::ProductionGap

Inherits Enum < Comparable < Value < Object

A protection that is off, or weaker than it looks, in a configuration that boots fine.

Every one of these is either a default or one argument away from one, and each was chosen for a reason the shard still stands by: it cannot pick a login limit on an application's behalf, and disabling a factor after N failures would lock out people carrying years of typos. What was missing is a way to ask — so that "rate limiting is off" is something a deployment finds out at boot rather than from an incident review.

Constants

UnthrottledLogin = 0

rate_limiter: is a NullRateLimiter, the default: every login, reset and second-factor attempt is allowed, so bcrypt is a CPU lever and guessing is unmetered.

FailOpenLogin = 1

rate_limiter: is a FailOpenRateLimiter: while its store is down the login path runs unmetered, which is what an attacker gets by overwhelming the store (blueprints/0023-rate-limiter-store-failure.md).

ProcessLocalRateLimiter = 2

rate_limiter:, or the MFA recovery limiter, is one of the in-memory limiters (seen through a FailOpenRateLimiter). Each process counts on its own, so the effective limit is the configured one times the number of processes — 2.2× with six workers, measured (blueprints/0025, OPS-01). Correct for exactly one process.

UnboundedMfaGuessing = 3

MFA is configured with no mfa_max_consecutive_failures:, so a factor is never disabled however long it is guessed at, and NIST SP 800-63B's SHALL is unmet (blueprints/0029-second-factor-rate-limiting.md).

UnthrottledMfaRecovery = 4

MFA is configured and recovery codes are counted by a NullRateLimiter — one passed as mfa_recovery_rate_limiter:, or the default one inherited from rate_limiter: — so they can be guessed without limit.

InsecureSessionCookie = 5

The session cookie, or the remember-me cookie when remember-me is on, is not Secure. The allow_insecure: true escape hatch is for local HTTP development and nothing else.