new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

authentication/account_lockout

6 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Account lockout should use account-based counter

The counter of failed logins should be associated with the account itself, rather than the source IP address, in order to prevent an attacker from making login attempts from a large number of different IP addresses.

Account lockout policy parameters

When implementing an account lockout policy, consider: the number of failed attempts before the account is locked out (lockout threshold); the time period that these attempts must occur within (observation window); how long the account is locked out for (lockout duration). Some applications use exponential lockout where the duration starts short (e.g., 1 second) and doubles after each failed attempt. Consider a maximum of 2-3 account lockouts before permanent lockout.

Prevent account lockout denial of service

When designing an account lockout system, prevent it from being used to cause denial of service by locking out other users' accounts. One approach is to allow use of the forgotten password functionality to log in even if the account is locked out.

Forgot Password: do not lock account during reset request

Do not make a change to the account such as locking it out until a valid token is presented, as this can be used to deny access to users with known usernames.

Account lockout configuration in ASP.NET Core Identity

Set Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(30) and Lockout.MaxFailedAccessAttempts = 3 to implement account lockout after 3 failed login attempts for 30 minutes.

Implement brute-force protection on login routes

Protect login endpoints from brute-force attacks using modules like `express-bouncer`, `express-brute`, or `rate-limiter`. With `express-bouncer`, whitelist IPs, customize error messages, and increase delay per failed request. With `express-brute` using MemoryStore (local storage only, not production), return 429 on too many requests. With `rate-limiter`, specify request limits per IP per time period. Consider adding CAPTCHA using `svg-captcha` and implement account lockout mechanisms.

Give your agent this brain