{"action":"created","issue":{"url":"https://api.github.com/repos/anvilresearch/connect/issues/112","labels_url":"https://api.github.com/repos/anvilresearch/connect/issues/112/labels{/name}","comments_url":"https://api.github.com/repos/anvilresearch/connect/issues/112/comments","events_url":"https://api.github.com/repos/anvilresearch/connect/issues/112/events","html_url":"https://github.com/anvilresearch/connect/issues/112","id":92212519,"number":112,"title":"Support user lock-out after X number of failed sign-in attempts in Y time","user":{"login":"vsimonian","id":9868643,"avatar_url":"https://avatars.githubusercontent.com/u/9868643?v=3","gravatar_id":"","url":"https://api.github.com/users/vsimonian","html_url":"https://github.com/vsimonian","followers_url":"https://api.github.com/users/vsimonian/followers","following_url":"https://api.github.com/users/vsimonian/following{/other_user}","gists_url":"https://api.github.com/users/vsimonian/gists{/gist_id}","starred_url":"https://api.github.com/users/vsimonian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vsimonian/subscriptions","organizations_url":"https://api.github.com/users/vsimonian/orgs","repos_url":"https://api.github.com/users/vsimonian/repos","events_url":"https://api.github.com/users/vsimonian/events{/privacy}","received_events_url":"https://api.github.com/users/vsimonian/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-06-30T22:09:00Z","updated_at":"2015-06-30T23:07:15Z","closed_at":null,"body":"I think it would be worthwhile to implement a configurable feature that would allow a user to be locked out if there are X number of failed sign-in attempts in Y time. The lock-out would expire after Z amount of time, or when the administrator unlocked the user manually, whichever comes first. Lastly, the lock-out could be configured not to expire on its own and require manual intervention.\r\n\r\nI believe a feature like this would put Connect more within the realm of requirements that a corporate environment may have.\r\n\r\nTo be clear, this is a proposition for the password provider (local strategy), not external providers."},"comment":{"url":"https://api.github.com/repos/anvilresearch/connect/issues/comments/117368803","html_url":"https://github.com/anvilresearch/connect/issues/112#issuecomment-117368803","issue_url":"https://api.github.com/repos/anvilresearch/connect/issues/112","id":117368803,"user":{"login":"bnb","id":502396,"avatar_url":"https://avatars.githubusercontent.com/u/502396?v=3","gravatar_id":"","url":"https://api.github.com/users/bnb","html_url":"https://github.com/bnb","followers_url":"https://api.github.com/users/bnb/followers","following_url":"https://api.github.com/users/bnb/following{/other_user}","gists_url":"https://api.github.com/users/bnb/gists{/gist_id}","starred_url":"https://api.github.com/users/bnb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bnb/subscriptions","organizations_url":"https://api.github.com/users/bnb/orgs","repos_url":"https://api.github.com/users/bnb/repos","events_url":"https://api.github.com/users/bnb/events{/privacy}","received_events_url":"https://api.github.com/users/bnb/received_events","type":"User","site_admin":false},"created_at":"2015-06-30T23:07:14Z","updated_at":"2015-06-30T23:07:14Z","body":"@vsimonian By that I just meant the logic and code behind restricting access to the right place at the right time - i.e. limiting users with certain traits (IP, IP range, browser config, connection type, and so on) but not others, which is the way I imagined this would be solved. "}}