Preventing Bruteforce

Question

Possible Duplicate:
Preventing Brute Force Logins on Websites
Limiting user login attempts in PHP

I wanted to know what would be a best way to prevent brute forcing in a log in form. Meaning how can i save the number of tries and time limit? Would session be a good idea?

Thanks.

What have you tried? This is pretty general? If you want anything to last beyond page refresh, you'll need persistent storage. Obviously session is an example of that. — Jason McCreary, Mar 10 '12 at 02:50

score 2 · Accepted Answer · answered Mar 10 '12 at 02:53

You can automatically start a session for each person who hits your site. Then in the session variable, store the number of login attempts and if they are blocked, a time when they will be unlocked.

When processing the login, if the password and username does not match and the time limit has not expired and the number of tries has been exceeded, display a message to the user.

Your database table could look like this:

sessions
==========
id
num_tries //Number of login attemps
block_expires //If they are blocked, when they can be unblocked.

This approach assumes that the user will assume a session cookie. They can easily get around this by clearing their cookies.

In order to mitigate that some what, you can build some smarts into the process:

If the logins are coming from the same IP address AND the account they are trying to access does not change, then block the account (not the session!) for a set period of time.

I would strongly advise against that, what if the attacker disable sessions? — David 天宇 Wong, Apr 07 '14 at 10:09

score 0 · Answer 2 · answered Mar 10 '12 at 02:53

This is discussed here.

The consensus was that you can make an SQL table of failed attempts along with timestamps for each one. Then you would query that on a failed login and check the number of attempts and timestamps using cookies or querying every time.

Preventing Bruteforce

2 Answers2

Linked