{"action":"created","issue":{"url":"https://api.github.com/repos/benedmunds/CodeIgniter-Ion-Auth/issues/859","labels_url":"https://api.github.com/repos/benedmunds/CodeIgniter-Ion-Auth/issues/859/labels{/name}","comments_url":"https://api.github.com/repos/benedmunds/CodeIgniter-Ion-Auth/issues/859/comments","events_url":"https://api.github.com/repos/benedmunds/CodeIgniter-Ion-Auth/issues/859/events","html_url":"https://github.com/benedmunds/CodeIgniter-Ion-Auth/issues/859","id":110554637,"number":859,"title":"login attempts question","user":{"login":"nplaviola","id":12942584,"avatar_url":"https://avatars.githubusercontent.com/u/12942584?v=3","gravatar_id":"","url":"https://api.github.com/users/nplaviola","html_url":"https://github.com/nplaviola","followers_url":"https://api.github.com/users/nplaviola/followers","following_url":"https://api.github.com/users/nplaviola/following{/other_user}","gists_url":"https://api.github.com/users/nplaviola/gists{/gist_id}","starred_url":"https://api.github.com/users/nplaviola/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nplaviola/subscriptions","organizations_url":"https://api.github.com/users/nplaviola/orgs","repos_url":"https://api.github.com/users/nplaviola/repos","events_url":"https://api.github.com/users/nplaviola/events{/privacy}","received_events_url":"https://api.github.com/users/nplaviola/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2015-10-08T22:31:36Z","updated_at":"2015-10-09T15:05:31Z","closed_at":"2015-10-08T22:56:16Z","body":"I have the following configurations set:\r\n$config['track_login_attempts']       = TRUE;              \r\n$config['track_login_ip_address']     = TRUE;\r\n$config['maximum_login_attempts']     = 5;  \r\n$config['lockout_time']               = 600;  \r\n\r\nIt works fine in my application, recording the user identity and ip address, and clearing them away once the user logs in. However, if an attempt to login is made with multiple user names, upon a successful login none of the previous attempted user identity rows are deleted. This leads the function get_attempts_num() to report back >0  even after a successful login. I assume because it's checking for ip addresses and not also the user identity. It also restricts the number of login tries to 5 - the number of other existing user identities in the login attempts table.\r\n\r\nI suppose then my question is, why not clear away all attempts made from a certain ip address upon the successful login by any user on that ip address?"},"comment":{"url":"https://api.github.com/repos/benedmunds/CodeIgniter-Ion-Auth/issues/comments/146897525","html_url":"https://github.com/benedmunds/CodeIgniter-Ion-Auth/issues/859#issuecomment-146897525","issue_url":"https://api.github.com/repos/benedmunds/CodeIgniter-Ion-Auth/issues/859","id":146897525,"user":{"login":"danielslim","id":7088734,"avatar_url":"https://avatars.githubusercontent.com/u/7088734?v=3","gravatar_id":"","url":"https://api.github.com/users/danielslim","html_url":"https://github.com/danielslim","followers_url":"https://api.github.com/users/danielslim/followers","following_url":"https://api.github.com/users/danielslim/following{/other_user}","gists_url":"https://api.github.com/users/danielslim/gists{/gist_id}","starred_url":"https://api.github.com/users/danielslim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danielslim/subscriptions","organizations_url":"https://api.github.com/users/danielslim/orgs","repos_url":"https://api.github.com/users/danielslim/repos","events_url":"https://api.github.com/users/danielslim/events{/privacy}","received_events_url":"https://api.github.com/users/danielslim/received_events","type":"User","site_admin":false},"created_at":"2015-10-09T15:05:31Z","updated_at":"2015-10-09T15:05:31Z","body":"I get what @avenirer is saying. co-workers in the same network likely to have same IP, so if the login fail limit is 5, then i can use co-worker username try for 4 times, clearing IP failed attempt count by using my username, then try the co-worker login repeat it util i crack it? \r\n\r\nBut since clean_login_attempts doesn't clear all IP address, it only reset ip + login so you can't just reset all failed IP with a successful login... otherwise it would be security issue. "}}