Skip to content

WIP: [FIX] add brute force protection login and feedback on failed login

Manasse Ngudia requested to merge mnsuccess/tiki-manager:brute_force into master

Tiki Manager brute force protection If you enter 10 times an incorrect password when login to Tiki manager it should lock itself up like the Tiki installer does (once a Tiki is installed)

We assume attackers are clever and could do a brute-force attack from thousands of IP addresses.

So we need to disable the account after 10 failed logins from any IP.

But then we need a way to re-enable the account.

Ex.: one or many emails associated with the login. "Your account was locked because of too many failed login attempts. Click the following link to be able to log in again."

Edited by Jorge Sá Pereira

Merge request reports