How do you protect against brute-force login attempts?

Question

ICSM Computer · Answer

Protecting against brute-force login attempts is crucial to prevent unauthorized access. These attacks involve trying many username/password combinations rapidly. Here's how to effectively protect your application:
1. Rate Limiting
Limit the number of login attempts per IP or user.
Example: Allow only 5 login attempts per 10 minutes.In ASP.NET (Framework or Core), use middleware or libraries like:
ThrottleMiddleware (for ASP.NET Core)Custom ActionFilter or in-memory counters for ASP.NET MVC Framework
// Pseudo-example (ASP.NET)
if (TooManyFailedAttempts(userIp)) {
    return new HttpStatusCodeResult(429, "Too many attempts. Try again later.");
}
2. Account Lockout
Temporarily lock the user account after repeated failures.
Example: Lock for 15 minutes after 5 failed logins.Can be stored in DB: FailedAttempts, LastFailedTime,
IsLockedUntilASP.NET Identity (Core or Full Framework) supports this:
manager.MaxFailedAccessAttemptsBeforeLockout = 5;
manager.DefaultAccountLockoutTimeSpan = TimeSpan.FromMinutes(15);
3. IP Blacklisting / Throttling
Block or slow down suspicious IPs.Track failed logins per IP in memory or RedisBlock IP if thresholds are exceeded
4. CAPTCHA
Trigger CAPTCHA after several failed login attempts to prevent automated scripts.Google reCAPTCHA or hCaptchaAdd to login form after 3–5 failures
5. Strong Password Policies
Make brute-force less feasible by requiring strong passwords.Minimum length, uppercase, lowercase, number, special charactersUse 
ASP.NET Identity PasswordValidators
6. Two-Factor Authentication (2FA)
Even if credentials are guessed, access is blocked without the second factor.SMS, email OTP, authenticator app (TOTP)
7. Logging and Monitoring
Log failed login attempts and alert on anomalies.Alert if login attempts spike for a user or IPIntegrate with SIEM systems or logging services
8. Use SameSite and Secure Cookies
Prevents attackers from hijacking sessions during or after brute-force attempts.
9. Introduce Delay
Add small delays (e.g., 1–2 seconds) between login attempts.Slows down brute-force without hurting UX too muchEspecially helpful for unauthenticated endpoints
What Not to Do
Anti-Pattern
Why It's Bad
Only client-side validation
Easily bypassed by bots
Relying on obscurity (e.g., changing endpoint name)
Not reliable
Logging sensitive data like passwords
Major security risk
Summary
Technique
Benefit
Rate Limiting
Blocks excessive attempts
Account Lockout
Protects individual users
CAPTCHA
Stops bots
2FA
Blocks access after password
Logging
Helps with forensic analysis
Strong passwords
Makes brute-force harder
and

interview

How do you protect against brute-force login attempts?

ICSM Computer

Can you answer this question?

1 Answers

1. Rate Limiting

2. Account Lockout

3. IP Blacklisting / Throttling

4. CAPTCHA

5. Strong Password Policies

6. Two-Factor Authentication (2FA)

7. Logging & Monitoring

8. Use `SameSite` and Secure Cookies

9. Introduce Delay

What Not to Do

Summary

Liked By

Anti-Pattern	Why It's Bad
Only client-side validation	Easily bypassed by bots
Relying on obscurity (e.g., changing endpoint name)	Not reliable
Logging sensitive data like passwords	Major security risk

Technique	Benefit
Rate Limiting	Blocks excessive attempts
Account Lockout	Protects individual users
CAPTCHA	Stops bots
2FA	Blocks access after password
Logging	Helps with forensic analysis
Strong passwords	Makes brute-force harder