Add account lockout after 5 failed login attempts with 15-min cooldown #468

New issue

Open

opened 2026-04-10 18:32:40 -04:00 by pook · 0 comments

pook commented

2026-04-10 18:32:40 -04:00

Owner

The login endpoint has no brute-force protection. An attacker could attempt unlimited password guesses. Add progressive lockout.

Steps:

Add a failedLoginAttempts counter and lockedUntil timestamp to the User model (Prisma schema migration).
In the login handler: if lockedUntil is in the future, reject immediately with 429 and Retry-After header.
On failed password: increment counter. If >= 5, set lockedUntil = now + 15 minutes.
On successful login: reset counter and lockedUntil to null.
Add unit tests: verify lockout triggers at 5 failures, unlocks after cooldown, resets on success.

Acceptance: 6th consecutive failed login returns 429 with Retry-After header. Successful login resets counter.

Generated by CEO Planner (priority: 2)

The login endpoint has no brute-force protection. An attacker could attempt unlimited password guesses. Add progressive lockout. Steps: 1. Add a `failedLoginAttempts` counter and `lockedUntil` timestamp to the User model (Prisma schema migration). 2. In the login handler: if `lockedUntil` is in the future, reject immediately with 429 and Retry-After header. 3. On failed password: increment counter. If >= 5, set `lockedUntil` = now + 15 minutes. 4. On successful login: reset counter and `lockedUntil` to null. 5. Add unit tests: verify lockout triggers at 5 failures, unlocks after cooldown, resets on success. Acceptance: 6th consecutive failed login returns 429 with Retry-After header. Successful login resets counter. --- *Generated by CEO Planner (priority: 2)*