Problem/Motivation

The module does not currently track login attempts if the supplied username does not match a valid user. This limits its effectiveness in detecting and preventing attacks that are trying a range of possible account names. Being able to detect these and block the IP address would be a useful feature.

Also, if the system is configured to show remaining login attempts, it is easy for an attacker to determine which usernames are valid unless invalid usernames are treated identically.

Proposed resolution

Have the login attempt for invalid usernames recorded in the same manner as valid ones.

Issue fork login_security-3292972

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

jlscott created an issue. See original summary.

jlscott opened merge request !1

jayelless’s picture

jayelless commented
Status: Active » Needs review

Only a simple change required to implement this feature request. Change made and pushed. Merge request opened.

Anybody made their first commit to this issue’s fork.

anybody’s picture

anybody
Primary language German
Location Porta Westfalica
commented

Thanks @jlscott please have a look, shouldn't the return; functionality be kept?

anybody’s picture

anybody
Primary language German
Location Porta Westfalica
commented
Status: Needs review » Closed (duplicate)
Related issues: +#3050099: Wrong Message if User doesn't exist in the system

Closing this as duplicate of #3050099: Wrong Message if User doesn't exist in the system