| """ | |
| Security constants — shared configuration values. | |
| """ | |
| # MFA | |
| TOTP_DIGITS = 6 | |
| TOTP_INTERVAL_SECONDS = 30 | |
| BACKUP_CODE_COUNT = 10 | |
| # Sessions | |
| SESSION_DURATION_HOURS = 24 | |
| REFRESH_TOKEN_DURATION_DAYS = 30 | |
| INACTIVITY_TIMEOUT_MINUTES = 30 | |
| MAX_ACTIVE_SESSIONS = 5 | |
| # Rate Limiting | |
| LOGIN_MAX_ATTEMPTS = 5 | |
| LOGIN_BLOCK_SECONDS = 900 # 15 minutes | |
| API_MAX_ATTEMPTS = 100 | |
| API_BLOCK_SECONDS = 3600 # 1 hour | |