Redir to /auth/initial-setup after run in login rate limit

[z3ky]

Describe the Bug

Pangolin landing page redirects to /auth/initial-setup (ERROR 1682261561) after running into the login rate limit when the limit is configured like

rate_limits: auth: max_requests: 3

log.txt

Environment

• Ubuntu 26 LTS:
• Pangolin Version: 1.19.4
• Enterprise
• Gerbil Version: 1.4.2
• Traefik Version: 3.6
• Newt Version: no newt connection
• Client Version: Safari, Chrome

To Reproduce

• Configure rate limit
  rate_limits: auth: max_requests: 3
• Open pangolin landing page: pangolin.domain.org
• Login with invalid credentials for 3 times
• See the rate limit notification
• Reload the page several times

Expected Behavior

• See the login page with rate limit notification

[AstralDestiny]

Well showing the rate limit notification isn't good security hygiene it's better hygiene to not notify an attacker that anything they type will be accepted if they can reach the page.

So did the same max_requests and on EE I don't get redirected to initial-setup,

Sorry more context in the end you hope to have the rate limit window persist even though realistically it shouldn't even be shown to the user to enhance security?

[github-actions]

This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.