search

deis / controller

Deis Workflow Controller (API)
https://deis.com
MIT License
41 stars 53 forks source link

Proposal: Restrict the number of times a user can fail a login attempt #544

Open jchauncey opened 8 years ago

jchauncey commented 8 years ago

Right now we do not restrict the number of times people can fail a login attempt.

bacongobbler commented 8 years ago

Would some kind of rate-limiting feature fix this?

jchauncey commented 8 years ago

I think it depends on how complicated we want to get. Honestly, this probably plays into a larger theme feature which is Org management/security enhancements/(auth/id) management. But I think after 3 or 5 times you are locked out until an admin unlocks you or we trigger an unlock event somehow.

helgi commented 8 years ago

https://www.djangopackages.com/grids/g/antiflood/ here are a few - tho most will want a cache (redis / memcache) of some sort to store login attempts, etc

Joshua-Anderson commented 8 years ago

We have a redis component now so the cache is no longer a blocker.

helgi commented 8 years ago

That redis component is used for logging - we shouldn't be re-using components all too much. We could do it but then we'd have to do more sanity checking / users / acl kind of dealio so logger doesn't blow up controller cache and other way around

Joshua-Anderson commented 8 years ago

True, I was thinking we would use a second database on the redis component or we would deploy the deis-redis component twice, once for logger and once for the controller.

bacongobbler commented 8 years ago

Redis has a default of 32 "databases". IIRC logger is only using one, so there's nothing technically stopping us from using another :)

Cryptophobia commented 6 years ago

This issue was moved to teamhephy/controller#67