Flask-security: Brute force protection on login failure

[mafrosis]

I don't believe there is anything in Flask-Security that provides IP-based timing delays to prevent brute force login attempts. Please correct me if I'm wrong!

If it's missing, I will implement it in the coming months.

[spitzbubchen]

I would like to see this implemented. Two days ago I experienced a brute force attack. Luckily, flask-security held up and the attacker didn't get past the login screen. The hacker was averaging about 7 login attempts per second.

[nfvs]

I'm not sure doing this in Flask is a good idea, since you'd be wasting resources that would be best used to process legitimate requests.

This is something that's best done in the web server itself. If you're using Nginx, this can easily be accomplished by using the "ngx_http_limit_req_module" module: http://nginx.org/en/docs/http/ngx_http_limit_req_module.html

[ldupuy]

Yes, but a recaptcha after 3 or 5 errors could be great, i think.

[jonafato]

I believe this is related to (but not necessarily a duplicate of) #161.

[cbronazc]

+1. The nginx or flask-limiter solutions are aimed at rate-limiting a particular IP, but that doesn't address an attacker going after one specific user. I would prefer either to lock the account after _N_ failed attempts and force the user to reset via email, or lock account for _N_ minutes. Here is a good example implementation in Ruby.. Or what if we add a hook/signal on a failed attempt to allow users to implement themselves.

[rakeshmukundan]

I am looking to add "lock" support for a particular user account after N failed login. Anyone else is working on this? if else would love to do it

[jirikuncar]

@rakeshmukundan you can try to propose a PR. See my other comment with possible solution using custom login form https://github.com/mattupstate/flask-security/issues/161#issuecomment-310921347. You can also disable account from the form and send them a notification via email.