FreakAuth light 1.1 released

[eluser]Natebot[/eluser]
good question. Here are my thoughts, just off the cuff.

You need to know the number of failed attempts, the user name, and possibly the time of the last failed attempt.

You could store the failed attempts per user name in an array in the user data of the session, incrementing the failed attempts with each failure and testing it against your maximum allowed failed attempts (probably set in a config file). Then the user would have to wait till the session times out before being allowed to log in again. This doesn't keep people from dumping session cookies or using another browser to attempt new logins.

To prevent that, you could add columns to your user table for failure count and a locked account timestamp. The login process could check this timestamp, and if it is less than X number of minutes (set in config file) then return a locked account message. Some systems lock an account and require a user to engage in an additional verification process (such as a lost password email verification) or input before unlocking rather than just letting time pass.

I agree Freakauth, well any auth sytem≤, could really benefit from lockout functionality. I'm sure I've missed something important in my appraisal, so I hope others contribute.