TryGhost/Ghost — pull request #1850 by hswolff (2014-01-05 02:49:02+00:00)
Title: Remove successful login connections from the auth

throttle list

- once a user has successfully logged into ghost
they no longer are a malicious user and as such
their IP address should be removed from the
array of login attempts

- should also reduce the memory usage of Ghost
as the loginSecurity array gets pruned upon
every successful login

- this also fixes a race condition i was experiencing
during functional tests wherein i would receive
the login throttle message during regular testing.
Seems my machine is able to run casper fast enough
that it could complete each test under an amount
of time that tripped the login throttle message.

I found this improvement from my woes and tribulations while trying to run functional tests locally. Seems my MacBookPro Retina with a 2.7 GHz Intel Core i7 and 16 GB 1600 MHz DDR3 is so fast that casper completes tests in such a manner that it trips the throttle behavior. This was insane to track down...oh man.

Also please think of any security ramifications this may have. It should be ok, for as soon as a user is logged in they can't be considered malicious - for they're logged in. If they stole the user/pass there's no way for us to know that, all this behavior can do is prevent brute force login attempts.