New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

security: stop timing attacks #57

Open

cyberhck opened this issue Jun 23, 2021 · 0 comments

Contributor

cyberhck commented Jun 23, 2021

while we're using bcrypt to do the hashing, I want to add extra layer of security,

whenever a user enters wrong password, I want to delay the response by LoginAttempts seconds before responding with a login failed.

This also solves bruteforcing issue. (Lockout already solved it, but this will be extra layer of security)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment