Expand description
Per-username throttling of password authentication attempts.
Kellnr often runs behind a reverse proxy, where every request shares the proxy’s IP address. Throttling by IP would lock out all users at once, so attempts are counted per username instead. Unknown usernames are counted the same way, so the throttle does not reveal which users exist.