Problem/Motivation

Since Drupal core implements hidden flood control variables on user and ip level (with an optional non-core interface: https://www.drupal.org/project/flood_control), login_security's functionality easily collides with these hidden variables.

Steps to reproduce

Set max user login attempts to anything above 5. Since the default user login limit by flood_control (aka the user module) is 5, flood control blocks the login attempt even before login_security's max login attempt can be reached.

Proposed resolution

Discuss and implement better communication between the user modules "user.flood" config and the login_security module.

Remaining tasks

User interface changes

API changes

Data model changes

Comments

Grevil created an issue. See original summary.

anybody’s picture

anybody
Primary language German
Location Porta Westfalica
commented
Title: Improve behaviour with the user module's flood control » [META] Improve behaviour with the user module's flood control
grevil’s picture

grevil commented
Related issues: +#3050099: Wrong Message if User doesn't exist in the system
grevil’s picture

grevil commented

This module creates its own database "login_security_track" for tracking login events. We should check if Drupal core flood control creates a similar database, which we can use instead of creating our own.