Open neckhair opened 8 years ago
Looks good to me! Maybe it should be possible to deactivate this feature (set max_failed_login_attempts
to 0
)?
@pencil, @luxflux: what do you think?
Maybe it should be possible to deactivate this feature (set
max_failed_login_attempts
to 0)?
Yes, I agree. But IMHO we should use -1
to disable the feature.
I also would like to see the lock duration configurable, what do you think @calmyournerves, @pencil?
@calmyournerves @luxflux @pencil The feature can now be disabled by setting max_failed_login_attempts
to -1
. Also the timeout can be set with the config option failed_login_lock_timeout
.
LGTM
@pencil Good to merge?
I believe calling validate_login_credentials
before calling locked?
allows an attacker to use brute force with a timing attack in order to determine the password regardless of the account being locked out.
@pencil could you spend a few Minutes to review the latest changes?
This PR introduces a new configuration option
max_failed_login_attempts
with a default value of 5. When a user unsuccessfully tries to login 5 times in a row he gets locked for 5 minutes. Technically this is done by setting the attributelocked_until
with an offset of 5 minutes.