Add brute force login protection with progressive lockout #635

New issue

Open

opened 2026-04-11 07:46:53 -04:00 by pook · 0 comments

pook commented

2026-04-11 07:46:53 -04:00

Owner

The login endpoint lacks brute force protection. Add rate limiting and account lockout:

Implementation:

Add failed_login_attempts and locked_until columns to users table (migration)
On POST /api/auth/login: check if account is locked before credential check
On failed password: increment attempts, lock for 15min after 5 failures
On success: reset counter
Return 429 when locked, generic 401 for wrong password
Add integration tests for lockout and unlock behavior

Acceptance: 5 consecutive failed logins lock the account for 15 minutes. Tests pass. No information leakage.

Generated by CEO Planner (priority: 2)

The login endpoint lacks brute force protection. Add rate limiting and account lockout: Implementation: 1. Add failed_login_attempts and locked_until columns to users table (migration) 2. On POST /api/auth/login: check if account is locked before credential check 3. On failed password: increment attempts, lock for 15min after 5 failures 4. On success: reset counter 5. Return 429 when locked, generic 401 for wrong password 6. Add integration tests for lockout and unlock behavior Acceptance: 5 consecutive failed logins lock the account for 15 minutes. Tests pass. No information leakage. --- *Generated by CEO Planner (priority: 2)*