如何限制 Spring Security 中的登录尝试? [英] How can I limit login attempts in Spring Security?

问题描述

Spring Security 中是否有一些配置或可用模块来限制登录尝试(理想情况下，我希望在后续失败尝试之间增加等待时间)?如果不是，应该使用 API 的哪一部分?

Is there some configuration or available module in Spring Security to limit login attempts (ideally, I'd like to have an increasing wait time between subsequent failed attempts)? If not, which part of the API should be used for this?

推荐答案

实现一个 AuthenticationFailureHandler 来更新数据库中的计数/时间.我不会指望使用会话，因为攻击者无论如何都不会发送 cookie.

Implement an AuthenticationFailureHandler that updates a count/time in the DB. I wouldn't count on using the session because the attacker is not going to be sending cookies anyway.

这篇关于如何限制 Spring Security 中的登录尝试?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！