Skip to main content

post_session

acme_proxy_admin::webadmin::handlers::session

Function post_session 

Source 
pub async fn post_session(
    __arg0: State<AdminState>,
    __arg1: AdminClientIp,
    headers: HeaderMap,
    __arg3: Json<LoginRequest>,
) -> Result<Response, AdminError>
Expand description

POST /api/session — exchange a username and password for a session cookie.

The one route that is reachable without a session, so it carries its own protections: the origin gate (there is no CSRF token yet to check) and the rate limiter, which runs before the password hash so a flood does not cost 600 000 iterations per attempt. Both live in [sign_in], which the sign-in page calls too.