Agent WranglersAccess and accounts Required
Slow down password guessing
Limit failed logins per account and per address, and refuse passwords known from breaches.
How to do it
After a few failures, add a delay or a challenge for that account. Rate limit the login route as a whole. Check new passwords against a breached list, such as the Have I Been Pwned range API. Give the same error for a wrong user and a wrong password. Follow NIST SP 800-63B for passwords. Allow long passwords and pasting, and drop forced symbols and regular expiry. Offer two-factor login as well.
How to check
Send 20 wrong passwords to one test account in a minute. Later tries are slowed or blocked. The error for an unknown email reads the same as for a wrong password.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/login-guessing.