Using exponential back-off on login attempts

[robinvdvleuten]

Is it possible to add an exponential backoff on any login attempts? So for example each time an user fails to login, it needs to wait an exponential amount of time before trying it again.

[mariusbalcytis]

Only manually, at least currently.

Algorithm behind the scenes is always leaking bucket. So, user has X attempts per Y time. When Y time passes from the first attempt, she can try again once more.

As I've mentioned, we do those manually. For example:

maba_gentle_force:
    redis:
        host: localhost
    limits:
        login:
            -
                max_usages: 3
                period: 1m
            -
                max_usages: 10
                period: 1h
            -
                max_usages: 20
                period: 1d
    listeners:
        -
            path: ^/login$
            limits_key: login
            identifiers: [ip]

In this case, user has up to 3 incorrect attempts per 1 minute, up to 10 per 1 hour and up to 20 in 24 consecutive hours.