[Feature] User lock out for 5 minutes if more than 3 login failures are detected within 5 minutes

[norcino]

I have searched the existing feature requests, both open and closed, to make sure this is not a duplicate request.

• Yes

The feature

In order to prevent brute force attacks, which attackers can perform to crack the passwords, it is recommended to introduce a configurable lock out after a certain amount of login failures are detected in a certain time span.

The implementation can rely on a simple memory cache to keep the count of failed logins, using the cache TTL.
The failures should not be removed from cache even on successful logins as this might help attackers when genuine users logs in.

Also the block bound to the username, can be saved in cache and kept for as long as the TTL is set.

Platform

• Server
• Web
• Mobile

[bo0tzz]

You can handle this with tools like fail2ban.