Django account lockout

Question

Does anyone know of a Django App which can be used to extend django auth and lock accounts if a brute force password guessing attack is mounted?

Ie, an account lockout mechanism that restricts the number of login attempts.

Possible duplicate of [Lock out users after too many failed login attempts](http://stackoverflow.com/questions/9033287/lock-out-users-after-too-many-failed-login-attempts) — Jonny, Oct 19 '16 at 09:15
I guess the possible duplicate Jonny mentions asks it in a more 'stack overflow' appropriate manner, so please use that instead. The answer i got 7 years ago was very useful at the time :-) — stephendwolff, Jan 16 '18 at 10:06

score 6 · Accepted Answer · answered Mar 03 '11 at 10:46

6

answered Mar 03 '11 at 10:46

JamesO

1

Actually, it isn't quite perfect for my needs - it locks access to an IP address (and user-agent if desired) after a number of failed attempts, and this could be problematic in a situation where multiple users access a site on a NAT'ed network. Ie all users in an office will be locked out if one user goes over the limit! – stephendwolff Mar 03 '11 at 15:02

score 2 · Answer 2 · answered Jan 15 '18 at 22:58

2

answered Jan 15 '18 at 22:58

dan-klasson

score 2 · Answer 3 · answered Mar 03 '11 at 20:00

2

I created django-failedloginblocker for this purpose, and used django-brutebuster and, to a lesser extent, django-axes as inspiration.

answered Mar 03 '11 at 20:00

Alex Kuhl

both these look useful too - though i used django-axes in the end. – stephendwolff Apr 28 '11 at 10:10

score 1 · Answer 4 · answered Jul 26 '11 at 09:00

1

answered Jul 26 '11 at 09:00

mmrs151

Thanks @mmrs151 - i'll have a look at that at some point, though i'm not currently working on the project. – stephendwolff Jul 29 '11 at 16:16
this very simple package worked great for us for a long time but is abandoned with no py3 support – claytond Mar 11 '19 at 22:58

4 Answers4