Skip to content

Login throttling also takes into action when login in successful several times #40890

@jeroen-hoekstra

Description

@jeroen-hoekstra

Symfony version(s) affected: 5.2.6

Description
So we use login_throttling with a max_attempts set to 3 in our security.firewalls. When we login successful and logout again 3 times in 1 minute, the 4th time we want to login again we get the login_throttling error message saying "Too many failed login attempts, please try again in 1 minute". We saw this happen in our UI tests using Cypress where we login many times.

According to the docs it says: "One of the best countermeasures to these attacks is called “login throttling”, which denies a user from attempting logins after a certain number of failed attempts". In our case they are not failed attempts but still login_throttling is taking action.

Is this the expected behavior of login_throttling? If so, is there a way that we could make it work only for failed attempts?

How to reproduce
See Description

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions