Context
Authentication endpoints are targets for brute force attacks. Current rate limiting is not specific to login attempts.
Current Limitation/Problem
Login attempts have no per-account rate limiting. An attacker can try unlimited passwords against a single account, and there is no account lockout mechanism.
Expected Outcome
Progressive delay and account lockout for failed login attempts: delays increase exponentially, accounts lock after N attempts, with unlock via email verification or admin action.
Acceptance Criteria
- Track failed login attempts per account + IP
- Progressive delays: 1s, 5s, 30s, 2min, 10min, 1h after consecutive failures
- Account lockout after 10 consecutive failed attempts (within 24h window)
- Locked accounts cannot log in (all auth methods)
- Unlock: email verification link + time-based unlock (auto unlock after 24h)
- Admin unlock capability
- Notification email on account lockout
- Rate limit: max 3 login attempts/second per IP across all accounts
- Audit log for all login attempts (success/failure, IP, user agent)
- CAPTCHA after 3 failed attempts from same IP
Technical Scope
backend/src/middleware/brute-force.ts - brute force protectionbackend/src/services/auth/lockout-manager.ts - lockout logic- Redis: failed attempt counters with TTL, lockout state
- Prisma:
AccountLockout, LoginAttempt models
- Frontend: lockout notification UI, unlock flow
- Edge cases: distributed brute force (many IPs, one account), legitimate lockouts, concurrent attempts
Context
Authentication endpoints are targets for brute force attacks. Current rate limiting is not specific to login attempts.
Current Limitation/Problem
Login attempts have no per-account rate limiting. An attacker can try unlimited passwords against a single account, and there is no account lockout mechanism.
Expected Outcome
Progressive delay and account lockout for failed login attempts: delays increase exponentially, accounts lock after N attempts, with unlock via email verification or admin action.
Acceptance Criteria
Technical Scope
backend/src/middleware/brute-force.ts- brute force protectionbackend/src/services/auth/lockout-manager.ts- lockout logicAccountLockout,LoginAttemptmodels