It is necessary that after the user, upon login, entered the wrong password 5 times, the captcha was displayed

Closed due to the fact that the issue is too general for the participants Bald , D-side , Alex , user194374, HamSter 24 Dec '16 at 15:33 .

Please correct the question so that it describes the specific problem with sufficient detail to determine the appropriate answer. Do not ask a few questions at once. See “How to ask a good question?” For clarification. If the question can be reformulated according to the rules set out in the certificate , edit it .

  • Write to the session the number of input attempts. Next, read the number of these attempts and give the captcha. - ilyaplot
  • and if there is no session? - Jonny Manowar
  • Write somewhere else, for example in the cache. Only here it is not entirely clear how to identify the visitor. - ilyaplot
  • @JonnyManowar, do not need to be considered for a specific user. Do this: if the form had 3 input errors in 15-20-30-45 seconds, then show the captcha in it and keep the number of errors for the form, not for the user. If your brute force passwords go from 100 thousand addresses, then tracking errors on each user will not save you. - Visman
  • wrong attempts can be written to the database - Solo_777

1 answer 1

Laravel in trait ThrottlesLogins, and so considers the attempt to enter.

And the App \ Http \ Controllers \ Auth \ AuthController.php file can accept the following parameters:

protected $maxLoginAttempts = 10; // Кол-во попыток protected $lockoutTime = 300; // Время игнора

You can override one of the ThrottlesLogins methods, and instead of calling the locker, pass to the template that the captcha should be called.