I have a task of designing login system with the requirement below:

If the user login over three times, lock account for the first 5 minutes. The next failed 3 times login-in will lock the user account for good. Only the admin can unlock the account

The way i am design the system is that I create 3 more columns in the mysql user table to record the fail attempts from the users. The first one is enabled/disabled account status, the second is number of locked times, the third is to indicate if the user's account has been locked for the first time. So everytime a login request come in, the app will check back in the database to those login data of the user

So far it seems working fine. But overrall there is a time overhead in returning the token for the user(200 to 300 milliseconds). How could i improve the overrall response speed ? Is there something wrong with my design ? What could the problem solved in different way

  • 3
    There's something wrong with your database if it takes 200 to 300 ms to do one query on three columns.
    – Simon B
    Commented Apr 1, 2021 at 8:55
  • The time a fetch of a record takes is generally determined by the index - not by the number of columns. Are you sure when you altered the database table the index wasn't dropped? Commented Apr 11, 2021 at 23:27

1 Answer 1


Several thoughts:

Regarding your question: without looking at your code we can't tell where it wastes time. In general, the path for handling invalid logins should only affect invalid logins, which you don't want to speed up anyway. The valid login path should only be affected by the "login disabled" flag which belongs to the account data, and checking that should not take additional 200-300 milliseconds. Looks like you're doing something wrong.

Regarding the actual requirement: What is the actual goal? Improving security, or punishing users who are prone to typos? Disabling accounts by entering a wrong password several times in a row probably does not gain much security but opens a denial-of-service opportunity. You're probably not the one who sets the requirements but you might want to give feedback. If your service is accessible from the internet, it might make sense to block attacking IP addresses or ranges for increasing amounts of time if consecutive failed logins are detected (look at fail2ban for an example how this is often done on servers). If the service is only accessible from a private network where IP addresses can be traced back to users, the risk of getting caught performing such a denial-of-service attack might be high enough to keep people from doing it, but on the other hand the risk of actual attacks is also much lower, and you might prefer to alert some security people when an attack is detected. However, this would probably require another design than the simple three-strikes-and-you're-out.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.