[FEATURE REQUEST] Lack of Brute-Force Attack Protections

[ushka1]

Summary:

The system currently lacks robust protections against brute-force attacks, leaving user accounts vulnerable to unauthorized access through repeated login attempts.

Details:

During testing, it was observed that the system does not implement account lockout or throttling mechanisms after a defined threshold of consecutive failed login attempts. This exposes user accounts to the risk of brute-force attacks, where attackers can systematically guess passwords until successful.

Recommendation:

Implement effective brute-force attack prevention measures, such as account lockout, throttling, and time-based lockout. This will significantly enhance the system's security and mitigate the risk of unauthorized access.

Steps to Reproduce:

1. Attempt multiple consecutive failed login attempts using various passwords.
2. Observe the system's response to failed login attempts.

Expected Outcome:

The system should lock the account or apply throttling after surpassing the configured threshold, preventing further login attempts for a specified duration.

Note:

Addressing this issue is critical to fortify the system against brute-force attacks and uphold the overall security of user accounts.