diff options
Diffstat (limited to 'internal/game/core_login_account.go')
| -rw-r--r-- | internal/game/core_login_account.go | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/internal/game/core_login_account.go b/internal/game/core_login_account.go index e9fa67f..3b35b15 100644 --- a/internal/game/core_login_account.go +++ b/internal/game/core_login_account.go @@ -158,7 +158,10 @@ func (g *Game) handlePasswordOffOwner(sess *net.Session, input string) { return } throttle := g.ensureLoginThrottle() - key := loginThrottleKey(name, sess.RemoteAddr()) + // Key on the host, not RemoteAddr: the latter carries the ephemeral + // source port, so a reconnect would land on a fresh key and reset the + // escalation. RemoteHost strips the port (see net.Session.RemoteHost). + key := loginThrottleKey(name, sess.RemoteHost()) auth := passwordAuth{} acc, err := g.AccountStore.LoadAccount(name) switch { |