Repeated login attempts are a common way to attack password-protected applications. PHPRunner includes a built-in option to lock a user account after three unsuccessful login attempts. If that is all you need, enable Lock user account after three unsuccessful logins under the audit and locking settings. This option requires logging to a database.
This article demonstrates a different approach: temporarily blocking login attempts from the same IP address. After three unsuccessful attempts from an IP address, login access is blocked for 30 minutes.
Note: IP-based blocking is not the same as locking a user account. Multiple users may share the same public IP address, and applications running behind a proxy or load balancer may require additional configuration to determine the actual client IP.
Steps:
1. Create a table that stores unsuccessful login attempts.
The IP field uses 45 characters so it can store both IPv4 and IPv6 addresses.
2. Open your PHPRunner project and configure your normal login security settings.
3. Proceed to the Events screen and add the following three global events:
Before allowing a login attempt, check whether this IP address has already reached the limit.
After a successful login, clear the failed-attempt counter for this IP address.
After an unsuccessful login, increase the attempt counter and record the time of the attempt.
4. Build your project and test the login page.
After three unsuccessful login attempts from the same IP address, further login attempts from that address will be blocked for 30 minutes. A successful login resets the counter.
For most applications, PHPRunner's built-in account lockout is the simpler option. It locks the user account rather than the IP address and requires no custom event code.
IP-based blocking can be useful as an additional measure when you specifically want to slow repeated login attempts coming from the same source.
Applies to: