Home/ Questions/Q 6896163
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-27T07:00:01+00:00

I have a problem which I cannot seem to be able to resolve: I’m

  • 0

I have a problem which I cannot seem to be able to resolve: I’m creating a login process for an application; anytime a user attempts to login and fails, an attempt record is inserted/updated up to 5 attempts. After the 5th attempt, the account is locked.
I have 2 tables for that process, the ‘user’ table where the user information is kept, and the ‘attempts’ table.
First, I don’t want to use a session or cookie variable for the counting of attempts (cookies can be deleted, and session variables can become too much, since it’s a high traffic site); I plan to use an update statement to increase the number by 1.
Here’s where the confusion starts:

First, I’m not sure if I should update the row in the attempt table, or just insert a new row for every attempt (my preference is to insert on the first attempt, and to update the row on the remaining 4 attempts).
Second, I need a way to indicate that the attempt being made today is completely different from the one yesterday. For example, if a user attempted to log in yesterday, and succeeded after the third attempt, and then today, he attempted to login again, I don’t want the attempt to increment yesterday’s attempt. So, in a way, after every successful login, I need a way to ensure that any attempt after a successful login starts a new login process by itself.
I’m not sure if my question is clear. Please, ask for more clarification if needed.
I’ve racked my brain for 2 days without a solution to this process.

Thanks

P.S: I’m using stored procedure for most of the processing to eliminate the traveling back and forth for the processing.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Rather than have a separate table for login attempts, simply add a counter as a new integer column on the user table. Each time a failed attempt is made, increment that column for that record. Each time a successful login is made, reset that column to 0 for that record.

    If you need to keep a running audit of all attempts, that’s a separate concern. Auditing isn’t part of the login process. For that concern you’d write failed attempts to some kind of audit log. This log can be a table in the database, but shouldn’t be linked to the transactional tables in any way. And it can be a general logging system for all kind of application events, not just for failed logins. (Again, another concern entirely.)

    • 0