### Home Classes Methods

### In Files

- lib/authlogic/session/brute_force_protection.rb

### Namespace

- MODULE Authlogic::Session::BruteForceProtection::Config
- MODULE Authlogic::Session::BruteForceProtection::InstanceMethods

### Methods

- ::included

### Included Modules

- Authlogic::Session::BruteForceProtection::InstanceMethods

### Files

- LICENSE
- README.rdoc

### Class/Module Index

Quicksearch

- Authlogic
- Authlogic::ActsAsAuthentic
- Authlogic::ActsAsAuthentic::Base
- Authlogic::ActsAsAuthentic::Base::Config
- Authlogic::ActsAsAuthentic::Email
- Authlogic::ActsAsAuthentic::Email::Config
- Authlogic::ActsAsAuthentic::Email::Methods
- Authlogic::ActsAsAuthentic::LoggedInStatus
- Authlogic::ActsAsAuthentic::LoggedInStatus::Config
- Authlogic::ActsAsAuthentic::LoggedInStatus::Methods
- Authlogic::ActsAsAuthentic::LoggedInStatus::Methods::InstanceMethods
- Authlogic::ActsAsAuthentic::Login
- Authlogic::ActsAsAuthentic::Login::Config
- Authlogic::ActsAsAuthentic::Login::Methods
- Authlogic::ActsAsAuthentic::MagicColumns
- Authlogic::ActsAsAuthentic::MagicColumns::Methods
- Authlogic::ActsAsAuthentic::Password
- Authlogic::ActsAsAuthentic::Password::Callbacks
- Authlogic::ActsAsAuthentic::Password::Config
- Authlogic::ActsAsAuthentic::Password::Methods
- Authlogic::ActsAsAuthentic::Password::Methods::InstanceMethods
- Authlogic::ActsAsAuthentic::PerishableToken
- Authlogic::ActsAsAuthentic::PerishableToken::Config
- Authlogic::ActsAsAuthentic::PerishableToken::Methods
- Authlogic::ActsAsAuthentic::PerishableToken::Methods::ClassMethods
- Authlogic::ActsAsAuthentic::PerishableToken::Methods::InstanceMethods
- Authlogic::ActsAsAuthentic::PersistenceToken
- Authlogic::ActsAsAuthentic::PersistenceToken::Methods
- Authlogic::ActsAsAuthentic::PersistenceToken::Methods::ClassMethods
- Authlogic::ActsAsAuthentic::PersistenceToken::Methods::InstanceMethods
- Authlogic::ActsAsAuthentic::RestfulAuthentication
- Authlogic::ActsAsAuthentic::RestfulAuthentication::Config
- Authlogic::ActsAsAuthentic::RestfulAuthentication::InstanceMethods
- Authlogic::ActsAsAuthentic::SessionMaintenance
- Authlogic::ActsAsAuthentic::SessionMaintenance::Config
- Authlogic::ActsAsAuthentic::SessionMaintenance::Methods
- Authlogic::ActsAsAuthentic::SingleAccessToken
- Authlogic::ActsAsAuthentic::SingleAccessToken::Config
- Authlogic::ActsAsAuthentic::SingleAccessToken::Methods
- Authlogic::ActsAsAuthentic::SingleAccessToken::Methods::InstanceMethods
- Authlogic::ActsAsAuthentic::ValidationsScope
- Authlogic::ActsAsAuthentic::ValidationsScope::Config
- Authlogic::AuthenticatesMany
- Authlogic::AuthenticatesMany::Association
- Authlogic::AuthenticatesMany::Base
- Authlogic::ControllerAdapters
- Authlogic::ControllerAdapters::AbstractAdapter
- Authlogic::ControllerAdapters::MerbAdapter
- Authlogic::ControllerAdapters::MerbAdapter::MerbImplementation
- Authlogic::ControllerAdapters::RailsAdapter
- Authlogic::ControllerAdapters::RailsAdapter::AuthlogicLoadedTooLateError
- Authlogic::ControllerAdapters::RailsAdapter::RailsImplementation
- Authlogic::ControllerAdapters::SinatraAdapter
- Authlogic::ControllerAdapters::SinatraAdapter::Adapter
- Authlogic::ControllerAdapters::SinatraAdapter::Adapter::Implementation
- Authlogic::ControllerAdapters::SinatraAdapter::Controller
- Authlogic::ControllerAdapters::SinatraAdapter::Cookies
- Authlogic::CryptoProviders
- Authlogic::CryptoProviders::AES256
- Authlogic::CryptoProviders::BCrypt
- Authlogic::CryptoProviders::MD5
- Authlogic::CryptoProviders::Sha1
- Authlogic::CryptoProviders::Sha256
- Authlogic::CryptoProviders::Sha512
- Authlogic::CryptoProviders::Wordpress
- Authlogic::I18n
- Authlogic::I18n::Translator
- Authlogic::Random
- Authlogic::Regex
- Authlogic::Session
- Authlogic::Session::Activation
- Authlogic::Session::Activation::ClassMethods
- Authlogic::Session::Activation::InstanceMethods
- Authlogic::Session::ActiveRecordTrickery
- Authlogic::Session::ActiveRecordTrickery::ClassMethods
- Authlogic::Session::ActiveRecordTrickery::InstanceMethods
- Authlogic::Session::Base
- Authlogic::Session::BruteForceProtection
- Authlogic::Session::BruteForceProtection::Config
- Authlogic::Session::BruteForceProtection::InstanceMethods
- Authlogic::Session::Callbacks
- Authlogic::Session::Cookies
- Authlogic::Session::Cookies::Config
- Authlogic::Session::Cookies::InstanceMethods
- Authlogic::Session::Existence
- Authlogic::Session::Existence::ClassMethods
- Authlogic::Session::Existence::InstanceMethods
- Authlogic::Session::Foundation
- Authlogic::Session::Foundation::ClassMethods
- Authlogic::Session::Foundation::InstanceMethods
- Authlogic::Session::HttpAuth
- Authlogic::Session::HttpAuth::Config
- Authlogic::Session::HttpAuth::InstanceMethods
- Authlogic::Session::Id
- Authlogic::Session::Klass
- Authlogic::Session::Klass::Config
- Authlogic::Session::Klass::InstanceMethods
- Authlogic::Session::MagicColumns
- Authlogic::Session::MagicColumns::Config
- Authlogic::Session::MagicColumns::InstanceMethods
- Authlogic::Session::MagicStates
- Authlogic::Session::MagicStates::Config
- Authlogic::Session::MagicStates::InstanceMethods
- Authlogic::Session::Params
- Authlogic::Session::Params::Config
- Authlogic::Session::Params::InstanceMethods
- Authlogic::Session::Password
- Authlogic::Session::Password::Config
- Authlogic::Session::Password::InstanceMethods
- Authlogic::Session::PerishableToken
- Authlogic::Session::Persistence
- Authlogic::Session::Persistence::ClassMethods
- Authlogic::Session::Persistence::InstanceMethods
- Authlogic::Session::PriorityRecord
- Authlogic::Session::Scopes
- Authlogic::Session::Scopes::ClassMethods
- Authlogic::Session::Scopes::InstanceMethods
- Authlogic::Session::Session
- Authlogic::Session::Session::Config
- Authlogic::Session::Session::InstanceMethods
- Authlogic::Session::Timeout
- Authlogic::Session::Timeout::Config
- Authlogic::Session::Timeout::InstanceMethods
- Authlogic::Session::UnauthorizedRecord
- Authlogic::Session::Validation
- Authlogic::Session::Validation::Errors
- Authlogic::TestCase
- Authlogic::TestCase::MockController
- Authlogic::TestCase::MockLogger
- Authlogic::TestCase::RailsRequestAdapter
- Object

No matching classes.

# Authlogic::Session::BruteForceProtection

A brute force attacks is executed by hammering a login with as many password combinations as possible, until one works. A brute force attacked is generally combated with a slow hasing algorithm such as BCrypt. You can increase the cost, which makes the hash generation slower, and ultimately increases the time it takes to execute a brute force attack. Just to put this into perspective, if a hacker was to gain access to your server and execute a brute force attack locally, meaning there is no network lag, it would probably take decades to complete. Now throw in network lag and it would take MUCH longer.

But for those that are extra paranoid and can’t get enough protection, why not stop them as soon as you realize something isn’t right? That’s what this module is all about. By default the consecutive_failed_logins_limit configuration option is set to 50, if someone consecutively fails to login after 50 attempts their account will be suspended. This is a very liberal number and at this point it should be obvious that something is not right. If you wish to lower this number just set the configuration to a lower number:

    class UserSession < Authlogic::Session::Base
      consecutive_failed_logins_limit 10
    end

### Public Class Methods

included(klass) click to toggle source

    # File lib/authlogic/session/brute_force_protection.rb, line 18
    def self.included(klass)
      klass.class_eval do
        extend Config
        include InstanceMethods
        validate :reset_failed_login_count, :if => :reset_failed_login_count?
        validate :validate_failed_logins, :if => :being_brute_force_protected?
      end
    end

[Validate]

Generated with the Darkfish Rdoc Generator 2.