From 01867dba093734d51c67eb1177018661af87672b Mon Sep 17 00:00:00 2001 From: boban Date: Sat, 20 Jun 2026 18:06:11 +0200 Subject: [PATCH] harden(auth): capture login IP once, assert 2fa-failed audit --- app/Livewire/Auth/Login.php | 5 +++-- tests/Feature/BruteforceHooksTest.php | 1 + 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/app/Livewire/Auth/Login.php b/app/Livewire/Auth/Login.php index 929f298..1088f2b 100644 --- a/app/Livewire/Auth/Login.php +++ b/app/Livewire/Auth/Login.php @@ -66,13 +66,14 @@ class Login extends Component RateLimiter::hit($pairKey, 60); // 5 / minute RateLimiter::hit($ipKey, 60); // 20 / minute RateLimiter::hit($acctKey, 900); // 30 / 15 minutes - app(BruteforceGuard::class)->record(request()->ip(), 'login'); + $ip = request()->ip(); + app(BruteforceGuard::class)->record($ip, 'login'); AuditEvent::create([ 'user_id' => null, 'actor' => 'system', 'action' => 'auth.login_failed', 'target' => $this->email, - 'ip' => request()->ip(), + 'ip' => $ip, ]); throw ValidationException::withMessages(['email' => __('auth.invalid_credentials')]); } diff --git a/tests/Feature/BruteforceHooksTest.php b/tests/Feature/BruteforceHooksTest.php index 97b6a5b..591a768 100644 --- a/tests/Feature/BruteforceHooksTest.php +++ b/tests/Feature/BruteforceHooksTest.php @@ -81,5 +81,6 @@ class BruteforceHooksTest extends TestCase } $this->assertDatabaseHas('banned_ips', ['ip' => '203.0.113.6', 'reason' => '2fa']); + $this->assertDatabaseHas('audit_events', ['action' => 'auth.2fa_failed']); } }