Ratelimiting user logins

[lunny]

Feature Description

When a user inputs wrong password several times, Gitea should lock x minutes from that session to login again.

Screenshots

No response

[silverwind]

I suggest a high default like 10 logins in a 5 minute window because nothing is more obnoxious than when you're trying a few passwords that the site rate limits the retries too early. Ideally timeout should exponentially increase after limit is hit.

What should the limit be based upon? IP address?

[techknowlogick]

@silverwind yeah, IP because if you do it by username you could essentially lock out users by failing to log in as them a few times.

[techknowlogick]

I have a very rough PR for this here: #21181

Edit, oh lol I forgot you knew about that one already.

[silverwind]

I totally forgot about that one 😉

[eloydegen]

A CAPTCHA would be the best method in my view, otherwise there is still a risk of getting locked out by an attacker when something like Carrier Grade NAT is involved, although I'd see that as low risk.

[lunny]

Close since login with CAPTCHA has been implemented.

[techknowlogick]

CAPTCHAs aren't accessible, and so ratelimiting could provide an alternative

[silverwind]

We can offer both options, yes.