Skip to content

fix(core): add lockout after repeated failed login attempts - #1147

Open
mattibat wants to merge 2 commits into
citizenfx:developfrom
mattibat:fix/login-attempt-lockout
Open

fix(core): add lockout after repeated failed login attempts#1147
mattibat wants to merge 2 commits into
citizenfx:developfrom
mattibat:fix/login-attempt-lockout

Conversation

@mattibat

@mattibat mattibat commented Sep 17, 2026

Copy link
Copy Markdown

Problem

  • No brute force protection beyond bcrypt cost

Fix

  • Lockout per IP+username after 10 failed attempts
  • 5 minute lockout duration
  • Counter resets on successful login
  • Stale entries cleaned up periodically
  • Local requests exempt, same as existing rate limiter
  • In-memory only, resets on restart

@mattibat
mattibat requested a review from tabarra as a code owner September 17, 2026 18:43
@mattibat
fix(core): add lockout after repeated failed login attempts
5b9f3be 
Signed-off-by: matti.bat <138713607+mattibat@users.noreply.github.com>
@mattibat
mattibat force-pushed the fix/login-attempt-lockout branch from 2d422cc to 5b9f3be Compare September 17, 2026 18:54
@mattibat
fix(core): normalize username case in login lockout key
4febf6e 
Signed-off-by: matti.bat <138713607+mattibat@users.noreply.github.com>
@mattibat
mattibat force-pushed the fix/login-attempt-lockout branch from 3c894ae to 4febf6e Compare September 18, 2026 06:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tabarra tabarra Awaiting requested review from tabarra tabarra is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mattibat