2

I was reading about bruteforce login attack and one of the solution to prevent users from trying too many passwords in short amount of time is to add exponential delay for every failed login. But someone might do a DoS attack by keep trying to login with certain username.

I was thinking to do a window.location.reload() every say 5 failed login attempts, because it takes time reloading a page, and use a static one second delay before posting each login, assuming a normal user will take one second or more to type their password anyway.

Is this a good approach? what are the potentials for this to go wrong?

Improve this question
2
  • 1
    My alternative approach is to automatically add a "deny from" to .htaccess after a few failures (or a few occurrences of several other suspicious activities). And if getenv("HTTP_REFERER") returns NULL (or alternative ways of determining ip address fail), no login attempt is permitted in the first place. And, yeah, I started doing this after several dos attacks.
    – John Forkosh
    Commented Jun 9, 2018 at 12:15
  • By the way, when I said above that "I started doing this after several dos attacks", I should have mentioned that before doing what I did in response, I posted a similar-to-your question at serverfault.com/questions/771149 And my approach came out of the discussion there. Note that my question was eventually closed as off-topic, after which I followed-up that I'd originally posted it to >>this very site<< as softwareengineering.stackexchange.com/questions/316052 where it was closed off-topic, downvoted, deleted, with the suggestion to post it to serverfault (go figure:)
    – John Forkosh
    Commented Jun 11, 2018 at 12:43

1 Answer 1

Reset to default
7

It's not worth your effort.

It is trivial for hackers to make calls to your apis outside of the actual UI. The hacker trying to brute force / ddos your system is not actually sitting down and entering stuff into your ui.

So all you are doing is making your system worse for your actual users. And making your code harder to maintain.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.