Agent WranglersAPS-10Required
Slow down password guessing
Limit failed logins per account and per client address. Give the same error for a wrong user and a wrong password.
How to do it
After 5 failures in a row, add a growing delay or a challenge for that account. Never allow more than 100 failures in a row, as NIST SP 800-63B-4 requires. Rate limit the login route per client address as well, for example at 20 failures a minute. Count failures on every sign-in path, as hold every sign-in path to the same checks says. Password length, the breached-password list and paste live in accept long passwords and refuse breached ones. Offer two-factor login as well.
How to check
On the test copy, send 20 wrong passwords to one test account in a minute. Tries after the fifth are slowed or blocked. The error for an unknown email reads the same as for a wrong password. On a second test account, 101 failures spread over a day never succeed without a reset.
Sources
Related rules
- ACC-13 Accept long passwords and refuse breached ones in Accounts and identity
- ACC-65 Hold every sign-in path to the same checks in Accounts and identity
- ACC-79 Give the same answer for known and unknown accounts in Accounts and identity
- ACC-70 Offer two-factor login in Accounts and identity
- APS-49 Limit how often anyone can call your APIs in Application security
- APS-50 Take the client address only from proxies you run in Application security
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/authentication-and-sessions/login-guessing">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.