[auth] device id limits

This commit is contained in:
Devin Zuczek
2026-09-27 22:20:45 -04:00
parent 91db9ff82b
commit b090dc105a
5 changed files with 136 additions and 16 deletions
+5
View File
@@ -62,8 +62,13 @@ RECFLARE_DOMAIN=rec.example.com
# ...PER_IP counts accounts per signup IP — coarse, since a household, NAT or campus
# network shares one address. This is the one to raise (or zero out) if real players
# report being locked out.
# ...PER_DEVICE_ID counts accounts per client device id (the game's per-install hash,
# sent as `device_id`) — narrower than an IP and unmoved by a VPN, which is what the
# IP cap alone can't stop. Client-chosen, so it catches the stock client, not a script.
# Signups that post no device id (the website's) aren't counted.
# RECFLARE_MAX_ACCOUNTS_PER_PLATFORM_ID=3
# RECFLARE_MAX_ACCOUNTS_PER_IP=3
# RECFLARE_MAX_ACCOUNTS_PER_DEVICE_ID=3
# How far a ban reaches beyond the account it was handed to (`match` and `auth`), as a
# comma-separated list out of `ip` and `platform` — or `off` for neither. Unset means