feat: Add configurable Redis URL (claude)

* feat: Add login rate limiting (claude)
* feat: Add SameSite cookie attribute (claude)

Signed-off-by: KunoiSayami <[email protected]>

6 files changed, 112 insertions, 181 deletions

diff --git a/Cargo.lock b/Cargo.lock
index 71cad5e..de04e19 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -117,7 +117,7 @@ checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn",
 ]
 
 [[package]]
@@ -148,26 +148,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
 [[package]]
-name = "bindgen"
-version = "0.69.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "271383c67ccabffb7381723dea0672a673f292304fcb45c01cc648c7a8d58088"
-dependencies = [
- "bitflags",
- "cexpr",
- "clang-sys",
- "itertools 0.12.1",
- "lazy_static",
- "lazycell",
- "proc-macro2",
- "quote",
- "regex",
- "rustc-hash",
- "shlex",
- "syn 2.0.114",
-]
-
-[[package]]
 name = "bitflags"
 version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -223,15 +203,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "cexpr"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
-dependencies = [
- "nom",
-]
-
-[[package]]
 name = "cfg-if"
 version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -239,7 +210,7 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
 [[package]]
 name = "cgit-simple-authentication"
-version = "4.2.0"
+version = "4.4.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -249,10 +220,9 @@ dependencies = [
  "cpufeatures 0.3.0",
  "env_logger",
  "handlebars",
- "itertools 0.14.0",
+ "itertools",
  "log",
  "log4rs",
- "pam",
  "password-hash",
  "rand 0.10.0",
  "redis",
@@ -291,16 +261,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "clang-sys"
-version = "1.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b023947811758c97c59bf9d1c188fd619ad4718dcaa767947df1cadb14f39f4"
-dependencies = [
- "glob",
- "libc",
-]
-
-[[package]]
 name = "clap"
 version = "4.5.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -447,7 +407,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strsim",
- "syn 2.0.114",
+ "syn",
 ]
 
 [[package]]
@@ -458,7 +418,7 @@ checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
 dependencies = [
  "darling_core",
  "quote",
- "syn 2.0.114",
+ "syn",
 ]
 
 [[package]]
@@ -490,7 +450,7 @@ dependencies = [
  "darling",
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn",
 ]
 
 [[package]]
@@ -500,7 +460,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ab63b0e2bf4d5928aff72e83a7dace85d7bba5fe12dcc3c5a572d78caffd3f3c"
 dependencies = [
  "derive_builder_core",
- "syn 2.0.114",
+ "syn",
 ]
 
 [[package]]
@@ -521,7 +481,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustc_version",
- "syn 2.0.114",
+ "syn",
  "unicode-xid",
 ]
 
@@ -551,7 +511,7 @@ checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn",
 ]
 
 [[package]]
@@ -794,12 +754,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "glob"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
-
-[[package]]
 name = "handlebars"
 version = "6.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1044,15 +998,6 @@ checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
 
 [[package]]
 name = "itertools"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba291022dbbd398a455acf126c1e341954079855bc60dfdda641363bd6922569"
-dependencies = [
- "either",
-]
-
-[[package]]
-name = "itertools"
 version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
@@ -1087,7 +1032,7 @@ checksum = "ff7a39c8862fc1369215ccf0a8f12dd4598c7f6484704359f0351bd617034dbf"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn",
 ]
 
 [[package]]
@@ -1110,12 +1055,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "lazycell"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
-
-[[package]]
 name = "leb128fmt"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1237,12 +1176,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 
 [[package]]
-name = "minimal-lexical"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
-
-[[package]]
 name = "mio"
 version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1260,16 +1193,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dce6dd36094cac388f119d2e9dc82dc730ef91c32a6222170d630e5414b956e6"
 
 [[package]]
-name = "nom"
-version = "7.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
-dependencies = [
- "memchr",
- "minimal-lexical",
-]
-
-[[package]]
 name = "num-bigint"
 version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1362,39 +1285,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "pam"
-version = "0.8.0"
-source = "git+https://github.com/1wilkens/pam.git#daf26ae3512d8e5a7478ccff1e4232ef5ebf9b03"
-dependencies = [
- "libc",
- "memchr",
- "pam-macros",
- "pam-sys",
- "uzers",
-]
-
-[[package]]
-name = "pam-macros"
-version = "0.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c94f3b9b97df3c6d4e51a14916639b24e02c7d15d1dba686ce9b1118277cb811"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "pam-sys"
-version = "1.0.0-alpha5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce9484729b3e52c0bacdc5191cb6a6a5f31ef4c09c5e4ab1209d3340ad9e997b"
-dependencies = [
- "bindgen",
- "libc",
-]
-
-[[package]]
 name = "parking"
 version = "2.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1479,7 +1369,7 @@ dependencies = [
  "pest_meta",
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn",
 ]
 
 [[package]]
@@ -1571,7 +1461,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
 dependencies = [
  "proc-macro2",
- "syn 2.0.114",
+ "syn",
 ]
 
 [[package]]
@@ -1780,12 +1670,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "rustc-hash"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
-
-[[package]]
 name = "rustc_version"
 version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1902,7 +1786,7 @@ checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn",
 ]
 
 [[package]]
@@ -2109,7 +1993,7 @@ dependencies = [
  "quote",
  "sqlx-core",
  "sqlx-macros-core",
- "syn 2.0.114",
+ "syn",
 ]
 
 [[package]]
@@ -2132,7 +2016,7 @@ dependencies = [
  "sqlx-mysql",
  "sqlx-postgres",
  "sqlx-sqlite",
- "syn 2.0.114",
+ "syn",
  "tokio",
  "url",
 ]
@@ -2271,17 +2155,6 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "syn"
-version = "1.0.109"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "syn"
 version = "2.0.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d4d107df263a3013ef9b1879b0df87d706ff80f65a86ea879bd9c31f9b307c2a"
@@ -2299,7 +2172,7 @@ checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn",
 ]
 
 [[package]]
@@ -2332,7 +2205,7 @@ checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn",
 ]
 
 [[package]]
@@ -2395,7 +2268,7 @@ checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn",
 ]
 
 [[package]]
@@ -2481,7 +2354,7 @@ checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn",
 ]
 
 [[package]]
@@ -2610,16 +2483,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "uzers"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76d283dc7e8c901e79e32d077866eaf599156cbf427fffa8289aecc52c5c3f63"
-dependencies = [
- "libc",
- "log",
-]
-
-[[package]]
 name = "vcpkg"
 version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2693,7 +2556,7 @@ dependencies = [
  "bumpalo",
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn",
  "wasm-bindgen-shared",
 ]
 
@@ -2811,7 +2674,7 @@ checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn",
 ]
 
 [[package]]
@@ -2822,7 +2685,7 @@ checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn",
 ]
 
 [[package]]
@@ -3107,7 +2970,7 @@ dependencies = [
  "heck",
  "indexmap",
  "prettyplease",
- "syn 2.0.114",
+ "syn",
  "wasm-metadata",
  "wit-bindgen-core",
  "wit-component",
@@ -3123,7 +2986,7 @@ dependencies = [
  "prettyplease",
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn",
  "wit-bindgen-core",
  "wit-bindgen-rust",
 ]
@@ -3196,7 +3059,7 @@ checksum = "b659052874eb698efe5b9e8cf382204678a0086ebf46982b79d6ca3182927e5d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn",
  "synstructure",
 ]
 
@@ -3217,7 +3080,7 @@ checksum = "4122cd3169e94605190e77839c9a40d40ed048d305bfdc146e7df40ab0f3e517"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn",
 ]
 
 [[package]]
@@ -3237,7 +3100,7 @@ checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn",
  "synstructure",
 ]
 
@@ -3277,7 +3140,7 @@ checksum = "eadce39539ca5cb3985590102671f2567e659fca9666581ad3411d59207951f3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.114",
+ "syn",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 288effc..0b7e8b2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cgit-simple-authentication"
-version = "4.3.0"
+version = "4.4.0"
 authors = ["KunoiSayami <[email protected]>"]
 edition = "2024"
 
diff --git a/README.md b/README.md
index f75eb17..a5c391d 100644
--- a/README.md
+++ b/README.md
@@ -16,7 +16,7 @@ Simple authentication filter for [cgit](https://wiki.archlinux.org/title/Cgit) p
 ## Requirements
 
 - [Rust](https://www.rust-lang.org/) (for building from source)
-- [Redis](https://wiki.archlinux.org/title/Redis) (running on `127.0.0.1`)
+- [Redis](https://wiki.archlinux.org/title/Redis) (default: `127.0.0.1`, configurable via `cgit-simple-auth-redis-url`)
 - [cgit](https://wiki.archlinux.org/title/Cgit) with `auth-filter` support
 
 ## Building
@@ -59,8 +59,11 @@ All options are set in the `cgitrc` file:
 |---|---|---|
 | `cgit-simple-auth-cookie-ttl` | `1200` | Cookie time to live in seconds |
 | `cgit-simple-auth-database` | `/etc/cgit/auth.db` | SQLite database file path |
+| `cgit-simple-auth-redis-url` | `redis://127.0.0.1/` | Redis connection URL |
 | `cgit-simple-auth-bypass-root` | `false` | Skip authentication on the repository list (root) page |
 | `cgit-simple-auth-protect` | `full` | Protection mode: `full`, `part`, or `none` |
+| `cgit-simple-auth-max-login-attempts` | `5` | Max failed login attempts before lockout (0 to disable) |
+| `cgit-simple-auth-login-timeout` | `900` | Lockout duration in seconds after max failed attempts |
 
 ### Protection Modes
 
diff --git a/src/authentication.rs b/src/authentication.rs
index 151d7e0..05707f0 100644
--- a/src/authentication.rs
+++ b/src/authentication.rs
@@ -1,4 +1,3 @@
-
 use crate::datastructures::{Config, Cookie, FormData, WrapConfigure};
 use anyhow::Result;
 use clap::ArgMatches;
@@ -41,6 +40,30 @@ impl<R: BufRead, W: Write> IOModule<R, W> {
 
         let cfg = WrapConfigure::from(cfg);
         log::trace!("Method is {}", cfg.get_authorizer().method());
+
+        // Establish Redis connection early for rate limiting + session storage
+        let redis_client = redis::Client::open(cfg.get_config().redis_url.as_str())?;
+        let mut conn = redis_client.get_multiplexed_async_connection().await?;
+
+        // Rate limit check
+        let max_attempts = cfg.get_config().max_login_attempts;
+        let login_timeout = cfg.get_config().login_timeout;
+
+        if max_attempts > 0 {
+            let rate_limit_key = format!("cgit_auth_failed_{}", data.get_user());
+            let attempt_count: u64 = conn.get(&rate_limit_key).await.unwrap_or(0);
+            if attempt_count >= max_attempts {
+                log::warn!(
+                    "User {} is locked out due to too many failed login attempts",
+                    data.get_user()
+                );
+                writeln!(&mut self.writer, "Status: 403 Forbidden")?;
+                writeln!(&mut self.writer, "Cache-Control: no-cache, no-store")?;
+                writeln!(&mut self.writer)?;
+                return Ok(());
+            }
+        }
+
         let ret = verify_login(&cfg, &data).await;
 
         if let Err(ref e) = ret {
@@ -54,9 +77,13 @@ impl<R: BufRead, W: Write> IOModule<R, W> {
         }
 
         if ret.unwrap_or(false) {
-            let redis_conn = redis::Client::open("redis://127.0.0.1/")?;
+            // Clear failed attempt counter on successful login
+            if max_attempts > 0 {
+                let rate_limit_key = format!("cgit_auth_failed_{}", data.get_user());
+                let _: () = conn.del(&rate_limit_key).await.unwrap_or(());
+            }
+
             let cookie = Cookie::generate(data.get_user());
-            let mut conn = redis_conn.get_multiplexed_async_connection().await?;
 
             conn.set_ex::<_, _, String>(
                 format!("cgit_auth_{}", cookie.get_key()),
@@ -79,16 +106,31 @@ impl<R: BufRead, W: Write> IOModule<R, W> {
                 .get_one::<String>("http-referer")
                 .map(|s| s.as_str())
                 .unwrap_or("/");
-            let cookie_suffix = if is_secure { "; secure" } else { "" };
+            let cookie_suffix = if is_secure { "; Secure" } else { "" };
             writeln!(&mut self.writer, "Status: 302 Found")?;
             writeln!(&mut self.writer, "Cache-Control: no-cache, no-store")?;
             writeln!(&mut self.writer, "Location: {location}")?;
             writeln!(
                 &mut self.writer,
-                "Set-Cookie: cgit_auth={cookie_value}; Domain={domain}; Max-Age={}; HttpOnly{cookie_suffix}",
+                "Set-Cookie: cgit_auth={cookie_value}; Domain={domain}; Max-Age={}; HttpOnly; SameSite=Lax{cookie_suffix}",
                 cfg.get_config().cookie_ttl * 10,
             )?;
         } else {
+            // Increment rate limit counter on failed login
+            if max_attempts > 0 {
+                let rate_limit_key = format!("cgit_auth_failed_{}", data.get_user());
+                let new_count: u64 = conn.incr(&rate_limit_key, 1u64).await.unwrap_or(1);
+                if new_count == 1 {
+                    let _: () = conn
+                        .expire(&rate_limit_key, login_timeout as i64)
+                        .await
+                        .unwrap_or(());
+                }
+                log::info!(
+                    "Failed login attempt {new_count}/{max_attempts} for user {}",
+                    data.get_user()
+                );
+            }
             writeln!(&mut self.writer, "Status: 403 Forbidden")?;
             writeln!(&mut self.writer, "Cache-Control: no-cache, no-store")?;
         }
@@ -124,7 +166,7 @@ pub(crate) async fn cmd_authenticate_cookie(matches: &ArgMatches, cfg: Config) -
         return Ok(false);
     }
 
-    let redis_conn = redis::Client::open("redis://127.0.0.1/")?;
+    let redis_conn = redis::Client::open(cfg.redis_url.as_str())?;
     let mut conn = redis_conn.get_multiplexed_async_connection().await?;
 
     let redis_key = format!("cgit_repo_{repo}");
@@ -219,7 +261,6 @@ pub(crate) async fn verify_login(cfg: &WrapConfigure, data: &FormData) -> Result
     data.authorize(cfg.get_authorizer()).await
 }
 
-
 #[derive(Serialize)]
 pub struct Meta<'a> {
     action: &'a str,
@@ -463,7 +504,7 @@ pub(crate) async fn cmd_repo_user_control(
         return Err(anyhow::Error::msg("Invalid repository or username"));
     }
 
-    let redis_client = redis::Client::open("redis://127.0.0.1/")?;
+    let redis_client = redis::Client::open(cfg.redis_url.as_str())?;
     let mut redis_conn = redis_client.get_multiplexed_async_connection().await?;
 
     let mut conn = SqliteConnection::connect(cfg.get_database_location()).await?;
diff --git a/src/datastructures.rs b/src/datastructures.rs
index c312f8f..4ca1a00 100644
--- a/src/datastructures.rs
+++ b/src/datastructures.rs
@@ -23,7 +23,6 @@ use argon2::{
 use base64::Engine;
 use log::error;
 use rand::RngExt;
-use serde::{Deserialize, Serialize};
 use sqlx::ConnectOptions;
 use std::borrow::Cow;
 use std::fmt::{Debug, Formatter};
@@ -36,6 +35,9 @@ use url::form_urlencoded;
 const DEFAULT_CONFIG_LOCATION: &str = "/etc/cgitrc";
 const DEFAULT_COOKIE_TTL: u64 = 1200;
 const DEFAULT_DATABASE_LOCATION: &str = "/etc/cgit/auth.db";
+pub(crate) const DEFAULT_REDIS_URL: &str = "redis://127.0.0.1/";
+const DEFAULT_MAX_LOGIN_ATTEMPTS: u64 = 5;
+const DEFAULT_LOGIN_TIMEOUT: u64 = 900;
 pub const CACHE_DIR: &str = "/var/cache/cgit";
 pub type RandIntType = u32;
 pub const COOKIE_LENGTH: usize = 32;
@@ -73,12 +75,14 @@ pub(crate) trait TestSuite {
     fn generate_test_config() -> Self;
 }
 
-
 #[derive(Debug, Clone)]
 pub struct Config {
     pub cookie_ttl: u64,
     database: String,
+    pub redis_url: String,
     pub bypass_root: bool,
+    pub max_login_attempts: u64,
+    pub login_timeout: u64,
     pub(crate) test: bool,
     protect_config: ProtectSettings,
 }
@@ -88,7 +92,10 @@ impl Default for Config {
         Self {
             cookie_ttl: DEFAULT_COOKIE_TTL,
             database: DEFAULT_DATABASE_LOCATION.to_string(),
+            redis_url: DEFAULT_REDIS_URL.to_string(),
             bypass_root: false,
+            max_login_attempts: DEFAULT_MAX_LOGIN_ATTEMPTS,
+            login_timeout: DEFAULT_LOGIN_TIMEOUT,
             test: false,
             protect_config: Default::default(),
         }
@@ -105,7 +112,10 @@ impl Config {
 
         let mut cookie_ttl: u64 = DEFAULT_COOKIE_TTL;
         let mut database: &str = "/etc/cgit/auth.db";
+        let mut redis_url: &str = DEFAULT_REDIS_URL;
         let mut bypass_root: bool = false;
+        let mut max_login_attempts: u64 = DEFAULT_MAX_LOGIN_ATTEMPTS;
+        let mut login_timeout: u64 = DEFAULT_LOGIN_TIMEOUT;
         let mut protect_enabled: bool = true;
         let mut protect_white_list_mode: bool = true;
         //let mut skip_user_access_check: bool = false;
@@ -126,7 +136,12 @@ impl Config {
             match key_name {
                 "cookie-ttl" => cookie_ttl = value.parse().unwrap_or(DEFAULT_COOKIE_TTL),
                 "database" => database = value,
+                "redis-url" => redis_url = value,
                 "bypass-root" => bypass_root = value.to_lowercase().eq("true"),
+                "max-login-attempts" => {
+                    max_login_attempts = value.parse().unwrap_or(DEFAULT_MAX_LOGIN_ATTEMPTS)
+                }
+                "login-timeout" => login_timeout = value.parse().unwrap_or(DEFAULT_LOGIN_TIMEOUT),
                 "protect" => match value.to_lowercase().as_str() {
                     "full" => {
                         protect_enabled = true;
@@ -148,7 +163,10 @@ impl Config {
         Self {
             cookie_ttl,
             database: database.to_string(),
+            redis_url: redis_url.to_string(),
             bypass_root,
+            max_login_attempts,
+            login_timeout,
 
             test: false,
             protect_config: ProtectSettings::from_path(
@@ -245,8 +263,11 @@ impl TestSuite for Config {
     fn generate_test_config() -> Self {
         Self {
             database: "test/tmp.db".to_string(),
+            redis_url: DEFAULT_REDIS_URL.to_string(),
             bypass_root: false,
             cookie_ttl: DEFAULT_COOKIE_TTL,
+            max_login_attempts: DEFAULT_MAX_LOGIN_ATTEMPTS,
+            login_timeout: DEFAULT_LOGIN_TIMEOUT,
             test: true,
             protect_config: ProtectSettings::generate_test_config(),
         }
@@ -625,7 +646,6 @@ impl From<Config> for WrapConfigure {
     }
 }
 
-
 #[derive(Debug, Clone)]
 struct SQLAuthorizer {
     database_location: String,
diff --git a/src/test.rs b/src/test.rs
index a1d961b..7628921 100644
--- a/src/test.rs
+++ b/src/test.rs
@@ -55,7 +55,7 @@ mod core {
     }
 
     async fn async_test_redis() -> anyhow::Result<()> {
-        let redis_conn = redis::Client::open("redis://127.0.0.1/")?;
+        let redis_conn = redis::Client::open(crate::datastructures::DEFAULT_REDIS_URL)?;
         let mut conn = redis_conn.get_multiplexed_async_connection().await?;
 
         let s = rand_str(crate::datastructures::COOKIE_LENGTH);
@@ -344,10 +344,14 @@ mod core {
     }
 
     async fn clear_redis_setting() -> anyhow::Result<()> {
-        let client = redis::Client::open("redis://127.0.0.1")?;
+        let client = redis::Client::open(crate::datastructures::DEFAULT_REDIS_URL)?;
         let mut conn = client.get_multiplexed_async_connection().await?;
 
-        for key in &["cgit_repo_test", "cgit_repo_repo"] {
+        for key in &[
+            "cgit_repo_test",
+            "cgit_repo_repo",
+            "cgit_auth_failed_hunter2",
+        ] {
             conn.del::<_, i32>(*key).await?;
         }
         Ok(())