Password Bruteforce Implementation

Frappe Framework
1

Hi this is just a thought. The way password bruteforce prevention is implemented in frappe, it will be easy for any exterrnal user to lockout the administrator account.

Lets say I know the URL for the login screen I can keep entering the wrong password and the admin account will remain locked.

I would suggest that the account locking should be based on a combination of user account and IP address.

Please do share your thoughts.

2

An attacker may use different IPs to carry out their attack.

3

Yes they can but the number of public ips they can aquire are limited.
Also this approach is more secure than what is currently there.

The problem we are trying to solve here is that actual users who know the password should be able to login while other malicious users get blocked out.

2 Likes
4

@govindsmenokee You can turn on 2FA and disable brute force protection to achieve this.

1 Like