Bug #14676
closedAuthentication throttle time is based on time of previous login attempt
0%
Description
When doing a second throttling authentication attempt immediately after a first one, the remaining throttling time of the first one is subtracted from the second.
E.g.: with the default throttling times of 1 and then 5 seconds, the second throttling attempt only delays for 4 instead of 5 seconds.
Cause: both PasswordService::verifyPassword() as TotpProcess::verifyCode() first call AuthThrottle::delayForNextAttempt(), which compares with User::lastLoginAttempt(). This is set in User.setAuthenticated(), which is only called after calculating the delay.
Updated by Raf Pauwels 27 days ago
- Subject changed from MFA throttle time is based on time of previous login attempt to Authentication throttle time is based on time of previous login attempt
Updated by Romain Mardulyn 23 days ago
- Assignee set to Romain Mardulyn
- Target version set to 4.14.1
Updated by Romain Mardulyn 23 days ago ยท Edited
I do see a bug with TOTP throttling but not for passwords throttling.
For TOTP throttling, the biggest bug is actually that submitting a code while prevented to by throttling is counted as a attempt, therefor increasing the amount of time to wait before being able to make another attempt. This must be quite frustrating for users.
For the rest, it was only impacting the visual part. It was not really allowing a user to bypass the throttling.
Updated by Romain Mardulyn 23 days ago
- Status changed from InProgress to Review
- Assignee deleted (
Romain Mardulyn)
Updated by emil de keyser 13 days ago
- Status changed from Review to Resolved
- Assignee changed from emil de keyser to Romain Mardulyn
Updated by Romain Mardulyn 13 days ago
- Status changed from Resolved to Implemented @Emweb
- Private changed from Yes to No
Updated by Romain Mardulyn 6 days ago
- Status changed from Implemented @Emweb to Closed