We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Webmail is not exempt from rate limiting
## Environment & Version

- `docker compose version`:  _Docker Compose version 2.23.3_
- Version: mailu `2.0.34`

## Description
Trying to open my webmail (roundcube) the browser just showed an error due to _too many redirects_ - which were to `sso.php` of the webmailer.

Debugging this I found the following to be the reason:
> front-1       |  [info] 15#15: *153382 client login failed: "Temporary authentication failure (rate-limit)" while in http auth state, client: **172.29.0.3**, server: 0.0.0.0:10143, login: "user@example.net"

Where `172.29.0.3` is the IP of the webmail container.

As far as I could debug this everything else was working fine, `sso.php` could correctly get valid credentials provided by `front` via HTTP headers but trying to use them would fail since the webmail container was rate limited. The failed login would the redirect again to `sso.php` - in a loop...

## Replication Steps
Unfortunately I have no idea how the webmail container's IP could end up on the rate limited list...
The webmail container should only ever try to login with credentials provided by `front` via HTTP headers - which then should always be valid

## Observed behaviour
Webmailer was blocked by rate limiting, preventing it from successfully authenticate, causing its login in to fail and damning the browser into an infinite redirection loop.

## Expected behaviour
The webmailer should not be blocked by rate limiting since the credentials are passed from an already valid login via SSO anyway.

## Possible solutions
1. prevent the webmailer from hitting the rate limits: this requires some more debugging,since I don't know how it could end up rate limited in the first place since every login it tries should be successful...
2. exempt the webmail container from rate limits: this is the workaround I used now by adapting my `docker-compose.yml` config to give the network used by the webmailer a known subnet and exempting it from rate limits:
~~~diff
--- a/mailu.env
+++ b/.mailu.env
@@ -38,6 +38,10 @@ AUTH_RATELIMIT_IP=60/hour
 # Authentication rate limit per user (regardless of the source-IP)
 AUTH_RATELIMIT_USER=100/day
 
+# exempt webmail container from rate limiting
+WEBMAIL_SUBNET=172.29.0.0/24
+AUTH_RATELIMIT_EXEMPTION=$WEBMAIL_SUBNET
+
 # Opt-out of statistics, replace with "True" to opt out
 DISABLE_STATISTICS=False

--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -184,3 +184,7 @@ networks:
   webmail:
     driver: bridge
+    ipam:
+      driver: default
+      config:
+        - subnet: "$WEBMAIL_SUBNET"
~~~

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `core/admin/mailu/internal/views/auth.py`
Content:
```
1 from mailu import models, utils
2 from mailu.internal import internal, nginx
3 from flask import current_app as app
4 
5 import flask
6 import flask_login
7 import base64
8 import sqlalchemy.exc
9 import urllib
10 
11 @internal.route("/auth/email")
12 def nginx_authentication():
13     """ Main authentication endpoint for Nginx email server
14     """
15     client_ip = flask.request.headers["Client-Ip"]
16     headers = flask.request.headers
17     is_port_25 = headers["Auth-Port"] == '25'
18     if is_port_25 and headers['Auth-Method'] != 'none':
19         response = flask.Response()
20         response.headers['Auth-Status'] = 'AUTH not supported'
21         response.headers['Auth-Error-Code'] = '502 5.5.1'
22         utils.limiter.rate_limit_ip(client_ip)
23         return response
24     is_from_webmail = headers['Auth-Port'] in ['10143', '10025']
25     is_app_token = utils.is_app_token(headers.get('Auth-Pass',''))
26     if not is_from_webmail and not is_port_25 and not is_app_token and utils.limiter.should_rate_limit_ip(client_ip):
27         status, code = nginx.get_status(flask.request.headers['Auth-Protocol'], 'ratelimit')
28         response = flask.Response()
29         response.headers['Auth-Status'] = status
30         response.headers['Auth-Error-Code'] = code
31         return response
32     raw_password = urllib.parse.unquote(headers['Auth-Pass']) if 'Auth-Pass' in headers else ''
33     headers = nginx.handle_authentication(flask.request.headers)
34     response = flask.Response()
35     for key, value in headers.items():
36         response.headers[key] = str(value)
37     is_valid_user = False
38     username = response.headers.get('Auth-User', None)
39     if response.headers.get("Auth-User-Exists") == "True":
40         if not is_app_token and utils.limiter.should_rate_limit_user(username, client_ip):
41             # FIXME could be done before handle_authentication()
42             status, code = nginx.get_status(flask.request.headers['Auth-Protocol'], 'ratelimit')
43             response = flask.Response()
44             response.headers['Auth-Status'] = status
45             response.headers['Auth-Error-Code'] = code
46             return response
47         is_valid_user = True
48     if headers.get("Auth-Status") == "OK":
49         # successful email delivery isn't enough to warrant an exemption
50         if not is_port_25:
51             utils.limiter.exempt_ip_from_ratelimits(client_ip)
52     elif is_valid_user:
53         password = None
54         try:
55             password = raw_password.encode("iso8859-1").decode("utf8")
56         except:
57             app.logger.warn(f'Received undecodable password for {username} from nginx: {raw_password!r}')
58             utils.limiter.rate_limit_user(username, client_ip, password=None)
59         else:
60             utils.limiter.rate_limit_user(username, client_ip, password=password)
61     elif not is_from_webmail:
62         utils.limiter.rate_limit_ip(client_ip, username)
63     return response
64 
65 @internal.route("/auth/admin")
66 def admin_authentication():
67     """ Fails if the user is not an authenticated admin.
68     """
69     if (not flask_login.current_user.is_anonymous
70         and flask_login.current_user.global_admin
71         and flask_login.current_user.enabled):
72         return ""
73     return flask.abort(403)
74 
75 @internal.route("/auth/user")
76 def user_authentication():
77     """ Fails if the user is not authenticated.
78     """
79     if (not flask_login.current_user.is_anonymous
80         and flask_login.current_user.enabled):
81         response = flask.Response()
82         email = flask_login.current_user.get_id()
83         response.headers["X-User"] = models.IdnaEmail.process_bind_param(flask_login, email, "")
84         response.headers["X-User-Token"] = utils.gen_temp_token(email, flask.session)
85         return response
86     return flask.abort(403)
87 
88 
89 @internal.route("/auth/basic")
90 def basic_authentication():
91     """ Tries to authenticate using the Authorization header.
92     """
93     client_ip = flask.request.headers.get('X-Real-IP', flask.request.remote_addr)
94     if utils.limiter.should_rate_limit_ip(client_ip):
95         response = flask.Response(status=401)
96         response.headers["WWW-Authenticate"] = 'Basic realm="Authentication rate limit from one source exceeded"'
97         response.headers['Retry-After'] = '60'
98         return response
99     authorization = flask.request.headers.get("Authorization")
100     if authorization and authorization.startswith("Basic "):
101         encoded = authorization.replace("Basic ", "")
102         user_email, password = base64.b64decode(encoded).split(b":", 1)
103         user_email = user_email.decode("utf8")
104         if utils.limiter.should_rate_limit_user(user_email, client_ip):
105             response = flask.Response(status=401)
106             response.headers["WWW-Authenticate"] = 'Basic realm="Authentication rate limit for this username exceeded"'
107             response.headers['Retry-After'] = '60'
108             return response
109         try:
110             user = models.User.query.get(user_email) if '@' in user_email else None
111         except sqlalchemy.exc.StatementError as exc:
112             exc = str(exc).split('\n', 1)[0]
113             app.logger.warn(f'Invalid user {user_email!r}: {exc}')
114         else:
115             if user is not None and nginx.check_credentials(user, password.decode('utf-8'), client_ip, "web", flask.request.headers.get('X-Real-Port', None), user_email):
116                 response = flask.Response()
117                 response.headers["X-User"] = models.IdnaEmail.process_bind_param(flask_login, user.email, "")
118                 utils.limiter.exempt_ip_from_ratelimits(client_ip)
119                 return response
120             # We failed check_credentials
121             utils.limiter.rate_limit_user(user_email, client_ip) if user else utils.limiter.rate_limit_ip(client_ip, user_email)
122     response = flask.Response(status=401)
123     response.headers["WWW-Authenticate"] = 'Basic realm="Login Required"'
124     return response
125
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/core/admin/mailu/internal/views/auth.py b/core/admin/mailu/internal/views/auth.py
--- a/core/admin/mailu/internal/views/auth.py
+++ b/core/admin/mailu/internal/views/auth.py
@@ -37,7 +37,7 @@
     is_valid_user = False
     username = response.headers.get('Auth-User', None)
     if response.headers.get("Auth-User-Exists") == "True":
-        if not is_app_token and utils.limiter.should_rate_limit_user(username, client_ip):
+        if not is_from_webmail and not is_app_token and utils.limiter.should_rate_limit_user(username, client_ip):
             # FIXME could be done before handle_authentication()
             status, code = nginx.get_status(flask.request.headers['Auth-Protocol'], 'ratelimit')
             response = flask.Response()

{"golden_diff": "diff --git a/core/admin/mailu/internal/views/auth.py b/core/admin/mailu/internal/views/auth.py\n--- a/core/admin/mailu/internal/views/auth.py\n+++ b/core/admin/mailu/internal/views/auth.py\n@@ -37,7 +37,7 @@\n     is_valid_user = False\n     username = response.headers.get('Auth-User', None)\n     if response.headers.get(\"Auth-User-Exists\") == \"True\":\n-        if not is_app_token and utils.limiter.should_rate_limit_user(username, client_ip):\n+        if not is_from_webmail and not is_app_token and utils.limiter.should_rate_limit_user(username, client_ip):\n             # FIXME could be done before handle_authentication()\n             status, code = nginx.get_status(flask.request.headers['Auth-Protocol'], 'ratelimit')\n             response = flask.Response()\n", "issue": "Webmail is not exempt from rate limiting\n## Environment & Version\r\n\r\n- `docker compose version`:  _Docker Compose version 2.23.3_\r\n- Version: mailu `2.0.34`\r\n\r\n## Description\r\nTrying to open my webmail (roundcube) the browser just showed an error due to _too many redirects_ - which were to `sso.php` of the webmailer.\r\n\r\nDebugging this I found the following to be the reason:\r\n> front-1       |  [info] 15#15: *153382 client login failed: \"Temporary authentication failure (rate-limit)\" while in http auth state, client: **172.29.0.3**, server: 0.0.0.0:10143, login: \"user@example.net\"\r\n\r\nWhere `172.29.0.3` is the IP of the webmail container.\r\n\r\nAs far as I could debug this everything else was working fine, `sso.php` could correctly get valid credentials provided by `front` via HTTP headers but trying to use them would fail since the webmail container was rate limited. The failed login would the redirect again to `sso.php` - in a loop...\r\n\r\n## Replication Steps\r\nUnfortunately I have no idea how the webmail container's IP could end up on the rate limited list...\r\nThe webmail container should only ever try to login with credentials provided by `front` via HTTP headers - which then should always be valid\r\n\r\n## Observed behaviour\r\nWebmailer was blocked by rate limiting, preventing it from successfully authenticate, causing its login in to fail and damning the browser into an infinite redirection loop.\r\n\r\n## Expected behaviour\r\nThe webmailer should not be blocked by rate limiting since the credentials are passed from an already valid login via SSO anyway.\r\n\r\n## Possible solutions\r\n1. prevent the webmailer from hitting the rate limits: this requires some more debugging,since I don't know how it could end up rate limited in the first place since every login it tries should be successful...\r\n2. exempt the webmail container from rate limits: this is the workaround I used now by adapting my `docker-compose.yml` config to give the network used by the webmailer a known subnet and exempting it from rate limits:\r\n~~~diff\r\n--- a/mailu.env\r\n+++ b/.mailu.env\r\n@@ -38,6 +38,10 @@ AUTH_RATELIMIT_IP=60/hour\r\n # Authentication rate limit per user (regardless of the source-IP)\r\n AUTH_RATELIMIT_USER=100/day\r\n \r\n+# exempt webmail container from rate limiting\r\n+WEBMAIL_SUBNET=172.29.0.0/24\r\n+AUTH_RATELIMIT_EXEMPTION=$WEBMAIL_SUBNET\r\n+\r\n # Opt-out of statistics, replace with \"True\" to opt out\r\n DISABLE_STATISTICS=False\r\n\r\n--- a/docker-compose.yml\r\n+++ b/docker-compose.yml\r\n@@ -184,3 +184,7 @@ networks:\r\n   webmail:\r\n     driver: bridge\r\n+    ipam:\r\n+      driver: default\r\n+      config:\r\n+        - subnet: \"$WEBMAIL_SUBNET\"\r\n~~~\n", "before_files": [{"content": "from mailu import models, utils\nfrom mailu.internal import internal, nginx\nfrom flask import current_app as app\n\nimport flask\nimport flask_login\nimport base64\nimport sqlalchemy.exc\nimport urllib\n\n@internal.route(\"/auth/email\")\ndef nginx_authentication():\n    \"\"\" Main authentication endpoint for Nginx email server\n    \"\"\"\n    client_ip = flask.request.headers[\"Client-Ip\"]\n    headers = flask.request.headers\n    is_port_25 = headers[\"Auth-Port\"] == '25'\n    if is_port_25 and headers['Auth-Method'] != 'none':\n        response = flask.Response()\n        response.headers['Auth-Status'] = 'AUTH not supported'\n        response.headers['Auth-Error-Code'] = '502 5.5.1'\n        utils.limiter.rate_limit_ip(client_ip)\n        return response\n    is_from_webmail = headers['Auth-Port'] in ['10143', '10025']\n    is_app_token = utils.is_app_token(headers.get('Auth-Pass',''))\n    if not is_from_webmail and not is_port_25 and not is_app_token and utils.limiter.should_rate_limit_ip(client_ip):\n        status, code = nginx.get_status(flask.request.headers['Auth-Protocol'], 'ratelimit')\n        response = flask.Response()\n        response.headers['Auth-Status'] = status\n        response.headers['Auth-Error-Code'] = code\n        return response\n    raw_password = urllib.parse.unquote(headers['Auth-Pass']) if 'Auth-Pass' in headers else ''\n    headers = nginx.handle_authentication(flask.request.headers)\n    response = flask.Response()\n    for key, value in headers.items():\n        response.headers[key] = str(value)\n    is_valid_user = False\n    username = response.headers.get('Auth-User', None)\n    if response.headers.get(\"Auth-User-Exists\") == \"True\":\n        if not is_app_token and utils.limiter.should_rate_limit_user(username, client_ip):\n            # FIXME could be done before handle_authentication()\n            status, code = nginx.get_status(flask.request.headers['Auth-Protocol'], 'ratelimit')\n            response = flask.Response()\n            response.headers['Auth-Status'] = status\n            response.headers['Auth-Error-Code'] = code\n            return response\n        is_valid_user = True\n    if headers.get(\"Auth-Status\") == \"OK\":\n        # successful email delivery isn't enough to warrant an exemption\n        if not is_port_25:\n            utils.limiter.exempt_ip_from_ratelimits(client_ip)\n    elif is_valid_user:\n        password = None\n        try:\n            password = raw_password.encode(\"iso8859-1\").decode(\"utf8\")\n        except:\n            app.logger.warn(f'Received undecodable password for {username} from nginx: {raw_password!r}')\n            utils.limiter.rate_limit_user(username, client_ip, password=None)\n        else:\n            utils.limiter.rate_limit_user(username, client_ip, password=password)\n    elif not is_from_webmail:\n        utils.limiter.rate_limit_ip(client_ip, username)\n    return response\n\n@internal.route(\"/auth/admin\")\ndef admin_authentication():\n    \"\"\" Fails if the user is not an authenticated admin.\n    \"\"\"\n    if (not flask_login.current_user.is_anonymous\n        and flask_login.current_user.global_admin\n        and flask_login.current_user.enabled):\n        return \"\"\n    return flask.abort(403)\n\n@internal.route(\"/auth/user\")\ndef user_authentication():\n    \"\"\" Fails if the user is not authenticated.\n    \"\"\"\n    if (not flask_login.current_user.is_anonymous\n        and flask_login.current_user.enabled):\n        response = flask.Response()\n        email = flask_login.current_user.get_id()\n        response.headers[\"X-User\"] = models.IdnaEmail.process_bind_param(flask_login, email, \"\")\n        response.headers[\"X-User-Token\"] = utils.gen_temp_token(email, flask.session)\n        return response\n    return flask.abort(403)\n\n\n@internal.route(\"/auth/basic\")\ndef basic_authentication():\n    \"\"\" Tries to authenticate using the Authorization header.\n    \"\"\"\n    client_ip = flask.request.headers.get('X-Real-IP', flask.request.remote_addr)\n    if utils.limiter.should_rate_limit_ip(client_ip):\n        response = flask.Response(status=401)\n        response.headers[\"WWW-Authenticate\"] = 'Basic realm=\"Authentication rate limit from one source exceeded\"'\n        response.headers['Retry-After'] = '60'\n        return response\n    authorization = flask.request.headers.get(\"Authorization\")\n    if authorization and authorization.startswith(\"Basic \"):\n        encoded = authorization.replace(\"Basic \", \"\")\n        user_email, password = base64.b64decode(encoded).split(b\":\", 1)\n        user_email = user_email.decode(\"utf8\")\n        if utils.limiter.should_rate_limit_user(user_email, client_ip):\n            response = flask.Response(status=401)\n            response.headers[\"WWW-Authenticate\"] = 'Basic realm=\"Authentication rate limit for this username exceeded\"'\n            response.headers['Retry-After'] = '60'\n            return response\n        try:\n            user = models.User.query.get(user_email) if '@' in user_email else None\n        except sqlalchemy.exc.StatementError as exc:\n            exc = str(exc).split('\\n', 1)[0]\n            app.logger.warn(f'Invalid user {user_email!r}: {exc}')\n        else:\n            if user is not None and nginx.check_credentials(user, password.decode('utf-8'), client_ip, \"web\", flask.request.headers.get('X-Real-Port', None), user_email):\n                response = flask.Response()\n                response.headers[\"X-User\"] = models.IdnaEmail.process_bind_param(flask_login, user.email, \"\")\n                utils.limiter.exempt_ip_from_ratelimits(client_ip)\n                return response\n            # We failed check_credentials\n            utils.limiter.rate_limit_user(user_email, client_ip) if user else utils.limiter.rate_limit_ip(client_ip, user_email)\n    response = flask.Response(status=401)\n    response.headers[\"WWW-Authenticate\"] = 'Basic realm=\"Login Required\"'\n    return response\n", "path": "core/admin/mailu/internal/views/auth.py"}], "after_files": [{"content": "from mailu import models, utils\nfrom mailu.internal import internal, nginx\nfrom flask import current_app as app\n\nimport flask\nimport flask_login\nimport base64\nimport sqlalchemy.exc\nimport urllib\n\n@internal.route(\"/auth/email\")\ndef nginx_authentication():\n    \"\"\" Main authentication endpoint for Nginx email server\n    \"\"\"\n    client_ip = flask.request.headers[\"Client-Ip\"]\n    headers = flask.request.headers\n    is_port_25 = headers[\"Auth-Port\"] == '25'\n    if is_port_25 and headers['Auth-Method'] != 'none':\n        response = flask.Response()\n        response.headers['Auth-Status'] = 'AUTH not supported'\n        response.headers['Auth-Error-Code'] = '502 5.5.1'\n        utils.limiter.rate_limit_ip(client_ip)\n        return response\n    is_from_webmail = headers['Auth-Port'] in ['10143', '10025']\n    is_app_token = utils.is_app_token(headers.get('Auth-Pass',''))\n    if not is_from_webmail and not is_port_25 and not is_app_token and utils.limiter.should_rate_limit_ip(client_ip):\n        status, code = nginx.get_status(flask.request.headers['Auth-Protocol'], 'ratelimit')\n        response = flask.Response()\n        response.headers['Auth-Status'] = status\n        response.headers['Auth-Error-Code'] = code\n        return response\n    raw_password = urllib.parse.unquote(headers['Auth-Pass']) if 'Auth-Pass' in headers else ''\n    headers = nginx.handle_authentication(flask.request.headers)\n    response = flask.Response()\n    for key, value in headers.items():\n        response.headers[key] = str(value)\n    is_valid_user = False\n    username = response.headers.get('Auth-User', None)\n    if response.headers.get(\"Auth-User-Exists\") == \"True\":\n        if not is_from_webmail and not is_app_token and utils.limiter.should_rate_limit_user(username, client_ip):\n            # FIXME could be done before handle_authentication()\n            status, code = nginx.get_status(flask.request.headers['Auth-Protocol'], 'ratelimit')\n            response = flask.Response()\n            response.headers['Auth-Status'] = status\n            response.headers['Auth-Error-Code'] = code\n            return response\n        is_valid_user = True\n    if headers.get(\"Auth-Status\") == \"OK\":\n        # successful email delivery isn't enough to warrant an exemption\n        if not is_port_25:\n            utils.limiter.exempt_ip_from_ratelimits(client_ip)\n    elif is_valid_user:\n        password = None\n        try:\n            password = raw_password.encode(\"iso8859-1\").decode(\"utf8\")\n        except:\n            app.logger.warn(f'Received undecodable password for {username} from nginx: {raw_password!r}')\n            utils.limiter.rate_limit_user(username, client_ip, password=None)\n        else:\n            utils.limiter.rate_limit_user(username, client_ip, password=password)\n    elif not is_from_webmail:\n        utils.limiter.rate_limit_ip(client_ip, username)\n    return response\n\n@internal.route(\"/auth/admin\")\ndef admin_authentication():\n    \"\"\" Fails if the user is not an authenticated admin.\n    \"\"\"\n    if (not flask_login.current_user.is_anonymous\n        and flask_login.current_user.global_admin\n        and flask_login.current_user.enabled):\n        return \"\"\n    return flask.abort(403)\n\n@internal.route(\"/auth/user\")\ndef user_authentication():\n    \"\"\" Fails if the user is not authenticated.\n    \"\"\"\n    if (not flask_login.current_user.is_anonymous\n        and flask_login.current_user.enabled):\n        response = flask.Response()\n        email = flask_login.current_user.get_id()\n        response.headers[\"X-User\"] = models.IdnaEmail.process_bind_param(flask_login, email, \"\")\n        response.headers[\"X-User-Token\"] = utils.gen_temp_token(email, flask.session)\n        return response\n    return flask.abort(403)\n\n\n@internal.route(\"/auth/basic\")\ndef basic_authentication():\n    \"\"\" Tries to authenticate using the Authorization header.\n    \"\"\"\n    client_ip = flask.request.headers.get('X-Real-IP', flask.request.remote_addr)\n    if utils.limiter.should_rate_limit_ip(client_ip):\n        response = flask.Response(status=401)\n        response.headers[\"WWW-Authenticate\"] = 'Basic realm=\"Authentication rate limit from one source exceeded\"'\n        response.headers['Retry-After'] = '60'\n        return response\n    authorization = flask.request.headers.get(\"Authorization\")\n    if authorization and authorization.startswith(\"Basic \"):\n        encoded = authorization.replace(\"Basic \", \"\")\n        user_email, password = base64.b64decode(encoded).split(b\":\", 1)\n        user_email = user_email.decode(\"utf8\")\n        if utils.limiter.should_rate_limit_user(user_email, client_ip):\n            response = flask.Response(status=401)\n            response.headers[\"WWW-Authenticate\"] = 'Basic realm=\"Authentication rate limit for this username exceeded\"'\n            response.headers['Retry-After'] = '60'\n            return response\n        try:\n            user = models.User.query.get(user_email) if '@' in user_email else None\n        except sqlalchemy.exc.StatementError as exc:\n            exc = str(exc).split('\\n', 1)[0]\n            app.logger.warn(f'Invalid user {user_email!r}: {exc}')\n        else:\n            if user is not None and nginx.check_credentials(user, password.decode('utf-8'), client_ip, \"web\", flask.request.headers.get('X-Real-Port', None), user_email):\n                response = flask.Response()\n                response.headers[\"X-User\"] = models.IdnaEmail.process_bind_param(flask_login, user.email, \"\")\n                utils.limiter.exempt_ip_from_ratelimits(client_ip)\n                return response\n            # We failed check_credentials\n            utils.limiter.rate_limit_user(user_email, client_ip) if user else utils.limiter.rate_limit_ip(client_ip, user_email)\n    response = flask.Response(status=401)\n    response.headers[\"WWW-Authenticate\"] = 'Basic realm=\"Login Required\"'\n    return response\n", "path": "core/admin/mailu/internal/views/auth.py"}]}