Jump to content

For login attempts check, should I do it by ip+username, just ip...?


someguy321

Recommended Posts

I want to limit the number of incorrect login attempts within a specified time period (e.g. 15 minutes). I'm wondering what I should tie those attempts to.

 

e.g. If too many attempts from one ip address for a specific username, lock them out for 15 minutes? Or too many attempts from any ip address for a specific username? Or too many attempts for an ip address matched loosely (i.e. 255.255.255.0 matching) with a specific username?

 

What's the best choice? Just too many attempts for a username? Or also use the ip address?

 

And should I store the attempts in the session, or the DB?

Link to comment
Share on other sites

Have a column in your DB that increments on bad attempts.  At 10 attempts, lock the account.

 

On a good atempt log them in and reset the attempts column

 

Sure, I understand, but my question is what makes an attempt? Simply a username? Or a username from a specific ip?

 

For example, consider the following two cases:

 

1. Person at ip 192.168.1.100 tried to login to "fakeuser"

2. Person at ip 192.168.1.100 tried to login to "fakeuser"

3. Person at ip 192.168.1.95 tried to login to "fakeuser"

 

Is this 3 attempts on "fakeuser"? Or is it two attempts by the first ip, and only 1 attempt by the second ip?

 

Link to comment
Share on other sites

This thread is more than a year old. Please don't revive it unless you have something important to add.

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.