Question

(This is in principal a language-agnostic question, though in my case I am using ASP.NET 3.5)

I am using the standard ASP.NET login control and would like to implement the following failed login attempt throttling logic.

• Handle the OnLoginError event and maintain, in Session, a count of failed login attempts
• When this count gets to [some configurable value] block further login attempts from the originating IP address or for that user / those users for 1 hour

Does this sound like a sensible approach? Am I missing an obvious means by which such checks could be bypassed?

Note: ASP.NET Session is associated with the user’s browser using a cookie

Edit

This is for an administration site that is only going to be used from the UK and India

Answer 1

Jeff Atwood mentioned another approach: Rather than locking an account after a number of attempts, increase the time until another login attempt is allowed:

1st failed login    no delay 2nd failed login    2 sec delay 3rd failed login    4 sec delay 4th failed login    8 sec delay 5th failed login    16 sec delay 

That would reduce the risk that this protection measure can be abused for denial of service attacks.

See http://www.codinghorror.com/blog/archives/001206.html