{"action":"opened","issue":{"url":"https://api.github.com/repos/mail-in-a-box/mailinabox/issues/697","repository_url":"https://api.github.com/repos/mail-in-a-box/mailinabox","labels_url":"https://api.github.com/repos/mail-in-a-box/mailinabox/issues/697/labels{/name}","comments_url":"https://api.github.com/repos/mail-in-a-box/mailinabox/issues/697/comments","events_url":"https://api.github.com/repos/mail-in-a-box/mailinabox/issues/697/events","html_url":"https://github.com/mail-in-a-box/mailinabox/issues/697","id":131000020,"number":697,"title":"Control panel security improvements","user":{"login":"gompster","id":1019412,"avatar_url":"https://avatars.githubusercontent.com/u/1019412?v=3","gravatar_id":"","url":"https://api.github.com/users/gompster","html_url":"https://github.com/gompster","followers_url":"https://api.github.com/users/gompster/followers","following_url":"https://api.github.com/users/gompster/following{/other_user}","gists_url":"https://api.github.com/users/gompster/gists{/gist_id}","starred_url":"https://api.github.com/users/gompster/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gompster/subscriptions","organizations_url":"https://api.github.com/users/gompster/orgs","repos_url":"https://api.github.com/users/gompster/repos","events_url":"https://api.github.com/users/gompster/events{/privacy}","received_events_url":"https://api.github.com/users/gompster/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-02-03T11:42:21Z","updated_at":"2016-02-03T11:42:21Z","closed_at":null,"body":"Hi,\r\n\r\nI would like to suggest some security improvements to the control panel web application:\r\n\r\n* Add the ability to restrict access to the control panel based on a whitelist of IP addresses (which could be configured in the control panel itself). An administrative interface should not be publicly accessible.\r\n* Use a generic 'login failed' message instead of giving an attacker information about whether a username exists in the system or not.\r\n* Implement protection against brute-force password guessing attacks, preferably by requiring the user to solve a CAPTCHA after ~5 failed login attempts.\r\n* Separate the login page from the rest of the application so that the URL structure (or available functionality) of the application is not revealed to an unauthenticated user.\r\n"}}