Security-PHP登录尝试功能

Question

I'm working on login form and I have to limit attempts to 3 and then block any form submit for 10 minutes. The following code isn't working correctly and I need to know how to block submitting after unsuccessful attempts. Thanks.

function autoDefender($attempts,$username,$pass)
    {
    $logins=0;
    $logins++;
    $ats = $attempts-$logins;
        if (isset($_POST['password']) && isset($_POST['userName']))
        {
            if($_POST['password']!=$pass && $_POST['userName']!=$username)
                {   
                    if($logins == $attempts)
                        {
                         echo ("<div class='errmg'>Acess denied for 1 minute</div>");
                        }
                    echo ("<div class='errmg'>Error:
                    invalid username or pass; <span class='atmpts'>$ats</span> attempts left</div>");
                }
        }
    }

Answer 1

The problem here is that with each call of autoDefender the local variable $logins is reset to 0. So the state of how many attempts actually took place is not not maintained across multiple calls of autoDefender.

You need to store this information somewhere persistently. In your case even across multiple requests.

Note that this does also poses an attack surface for Denial of Service attacks as you can lock-out other users. So you should think twice who you attribute a failed attempt to. If you do it per user, you an attacker might lock-out many users when doing a bulk attack on all users. If you do it per remote client (e.g. IP address), you might lock-out other innocent users that just happen to use the same system (e.g. company or university network). If you do it per session, an attacker might just drop the issued session ID.