I was reading about bruteforce login attack and one of the solution to prevent users from trying too many passwords in short amount of time is to add exponential delay for every failed login. But someone might do a DoS attack by keep trying to login with certain username.
I was thinking to do a
window.location.reload() every say 5 failed login attempts, because it takes time reloading a page, and use a static one second delay before posting each login, assuming a normal user will take one second or more to type their password anyway.
Is this a good approach? what are the potentials for this to go wrong?