feat(security): brute-force login protection with rate limiting #260

New Issue

2026-06-23T17:00:44Z

jmiller commented

2026-06-23 17:00:44 +00:00

Brute-Force Login Protection

Overview

Login-specific rate limiting separate from the general WAF auto-ban. Tracks failed login attempts per IP and per username, with progressive delays and lockouts.

Features

Failed login tracking — count failed attempts per IP and per username
Progressive delay — increase response time after each failure (1s, 2s, 4s, 8s...)
IP lockout — block IP after N failed attempts within time window (configurable)
Username lockout — temporarily lock account after N failed attempts
CAPTCHA trigger — show CAPTCHA after N failures (integrates with Joomla's CAPTCHA)
Whitelist bypass — trusted IPs exempt from rate limiting
Email notification — alert admin on lockout events
Lockout log — view and manage active lockouts from dashboard
Manual unlock — admin can release locked IPs/accounts

Database

CREATE TABLE #__mokosuiteclient_login_attempts (
  id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
  ip VARCHAR(45) NOT NULL,
  username VARCHAR(150) DEFAULT '',
  attempted DATETIME NOT NULL,
  success TINYINT(1) DEFAULT 0,
  KEY ip_time (ip, attempted),
  KEY username_time (username, attempted)
);

Architecture

Firewall plugin hooks into onUserLoginFailure and onUserAfterLogin
Check rate limits in onAfterRoute before login form renders
Integrates with existing auto-ban system (WAF blocks feed into same threshold)
Config fields added to firewall plugin XML

## Brute-Force Login Protection ### Overview Login-specific rate limiting separate from the general WAF auto-ban. Tracks failed login attempts per IP and per username, with progressive delays and lockouts. ### Features - **Failed login tracking** — count failed attempts per IP and per username - **Progressive delay** — increase response time after each failure (1s, 2s, 4s, 8s...) - **IP lockout** — block IP after N failed attempts within time window (configurable) - **Username lockout** — temporarily lock account after N failed attempts - **CAPTCHA trigger** — show CAPTCHA after N failures (integrates with Joomla's CAPTCHA) - **Whitelist bypass** — trusted IPs exempt from rate limiting - **Email notification** — alert admin on lockout events - **Lockout log** — view and manage active lockouts from dashboard - **Manual unlock** — admin can release locked IPs/accounts ### Database ```sql CREATE TABLE #__mokosuiteclient_login_attempts ( id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY, ip VARCHAR(45) NOT NULL, username VARCHAR(150) DEFAULT '', attempted DATETIME NOT NULL, success TINYINT(1) DEFAULT 0, KEY ip_time (ip, attempted), KEY username_time (username, attempted) ); ``` ### Architecture - Firewall plugin hooks into `onUserLoginFailure` and `onUserAfterLogin` - Check rate limits in `onAfterRoute` before login form renders - Integrates with existing auto-ban system (WAF blocks feed into same threshold) - Config fields added to firewall plugin XML

jmiller added this to the v03.00.00 milestone 2026-06-23 17:00:44 +00:00

jmiller commented

2026-06-23 17:00:47 +00:00

Branch created: feature/260-feat-security-brute-force-login-protecti

git fetch origin
git checkout feature/260-feat-security-brute-force-login-protecti

Branch created: [`feature/260-feat-security-brute-force-login-protecti`](https://git.mokoconsulting.tech/MokoConsulting/MokoSuiteClient/src/branch/feature/260-feat-security-brute-force-login-protecti) ```bash git fetch origin git checkout feature/260-feat-security-brute-force-login-protecti ```

Sign in to join this conversation.

Priority Medium

Type Feature

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoSuiteClient#260