Ashesh Vashi 9923eefcab docs: clarify scope of MAX_LOGIN_ATTEMPTS and document brute-force protection for LDAP ...

The "Avoiding a bruteforce attack" section in login.rst implied that
MAX_LOGIN_ATTEMPTS protected all logins; in fact it only applies to the
INTERNAL authentication source (the /authenticate/login view filters by
auth_source=INTERNAL). Operators using LDAP / OAUTH2 / KERBEROS /
WEBSERVER got no signal that brute-force protection lives at a different
layer.

Adds:

  - login.rst: the bruteforce section now states that MAX_LOGIN_ATTEMPTS
    is INTERNAL-only and points operators of external sources to the
    upstream identity provider's lockout policy and to the reverse proxy
    for IP-based throttling.
  - ldap.rst: a new "Brute-force protection" section calling out that
    LDAP credential lockout is the directory's responsibility (ppolicy /
    AD account-lockout GPO) and that request rate-limiting belongs on
    the proxy. Cross-references the login-page section.

No code change. Closes the documentation gap that surfaced during the
analysis of the #9904 lockout-bypass fix without inheriting the
maintenance burden of duplicating directory lockout in pgAdmin.

2026-05-05 15:03:00 +05:30

..

en_US

docs: clarify scope of MAX_LOGIN_ATTEMPTS and document brute-force protection for LDAP

2026-05-05 15:03:00 +05:30

proposals

fix: SESSION_DIGEST_METHOD default to sha256, follow-up review polish

2026-05-01 16:38:49 +05:30