Question

Does the WebSecurity class provide checking for number of password failures? If so, where is this configured?

With the old membership providers, this was configurable within web.config in the membership section. Is there something similar for simple membership?

Answer 1

I don’t think so, SimpleMembership basically doesn’t have any logic to automatically lock out accounts.

Instead you could determine lockout status via:

WebSecurity’s IsAccountLockedOut method:

public static bool IsAccountLockedOut(string userName, int allowedPasswordAttempts, int intervalInSeconds)