| #
563fb566 |
| 22-Jan-2026 |
Andreas Gohr <gohr@cosmocode.de> |
Add exponential timeout for failed login attempts
Introduces a configurable brute-force protection mechanism that enforces
increasing wait times between login attempts. The timeout doubles with
each
Add exponential timeout for failed login attempts
Introduces a configurable brute-force protection mechanism that enforces
increasing wait times between login attempts. The timeout doubles with
each failure (e.g., 5s → 10s → 20s → ...) up to a configurable maximum.
New settings:
- logindenial: Base timeout in seconds (0 to disable)
- logindenial_max: Maximum timeout cap (default 1 hour)
The feature works independently of CAPTCHA protection - failed attempts
are tracked per IP using the existing IpCounter mechanism, and users
are shown the remaining wait time when blocked.
show more ...
|