StephanRichter/LightOidc
1
0
Fork 0
Code Issues Pull Requests Actions Projects Releases Wiki Activity

implemented brute force protection

Browse Source 
Signed-off-by: Stephan Richter <s.richter@srsoftware.de>
This commit is contained in:
Stephan Richter
2024-10-18 13:57:43 +02:00
parent a4200f43aa
commit a10224a23e
3 changed files with 17 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
de.srsoftware.oidc.datastore.encrypted/src/main/java/de/srsoftware/oidc/datastore/encrypted/EncryptedUserService.java
View File

@@ -98,7 +98,7 @@ public class EncryptedUserService extends EncryptedConfig implements UserService
var optLock = getLock(username);
if (optLock.isPresent()) {
var lock = optLock.get();
LOG.log(WARNING, "{} is locked after {} failed logins. Lock will be released at {}", username, lock.attempts(), lock.releaseTime());
LOG.log(WARNING, "{0} is locked after {1} failed logins. Lock will be released at {2}", username, lock.attempts(), lock.releaseTime());
return empty();
}
for (var encryptedUser : backend.list()) {
@@ -109,7 +109,9 @@ public class EncryptedUserService extends EncryptedConfig implements UserService
return Optional.of(decryptedUser);
}
}
lock(username);
var lock = lock(username);
LOG.log(WARNING,"Login failed for {0} → locking account until {1}",username,lock.releaseTime());
return empty();
}