rate limit invalid login attempts to protect against brute force attacks.

[fool]

- Do you want to request a feature or report a bug?

• feature

- What is the current behavior?

• currently, you can attempt to guess a password for a known login repeatedly without any change in system behavior.

- If the current behavior is a bug, please provide the steps to reproduce.

• attempt to login with a wrong password dozens of times in a row.

- What is the expected behavior?

• it would be harder to brute force a password guessing attack on an account.

- Please mention your Go version, and operating system version.

N/A

[fool]

this unmerged/closed PR has some work in that area: https://github.com/netlify/gotrue/pull/104

[laurajodz]

Just noticed this issue isn't on a GH project - feel free to icebox! :)

[fool]

I think that Pod C owns gotrue based on this spreadsheet, so putting it in that project

[kaganjd]

closed with ~https://github.com/netlify/bitballoon/issues/6099~ https://github.com/netlify/gotrue/pull/248