Skip to content

Core-side throttling on finish / step_start #3585

Description

@wojcik91

Core imposes no rate limit, throttle, or backoff enforcement on MFA polling. Each finish poll is one SHA-256 plus one indexed point probe, idempotent, with no counter touch on MfaAwaitingExternal. The only binding ceiling is the fixed session window.

Why: poll cadence was handed to the desktop client (#934) as advisory guidance (~1s to ~5s backoff). Nothing about correctness depends on the client complying, which is precisely the argument for a server-side limit. A fast-pumping or buggy client is currently unbounded within the session window.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    Status
    New

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions