Detect Login Attempts

[stallionmvp]

Hi All,
I am trying to think of a technique to lock the user out say 5-10 minutes if
that user failed to authenticate three times consecutively within a minute. I
am thinking of implement using session variables only, and not using the sql
server tables. If anyone can post their good working approach to this, that
would be great. Thanks in advance.

[Pete Thomas]

If you really want to tie this down then a session based approach would not
really provide an answer as a new session could be easily created by a
perpetrator by either deleting their cookie or with the use of a robot client.
(ie CFHTTP). If you don't want to work with the database then APPLICATION
scope is the place to put your logic. I guess you would have to create some
kind of lookup including a user account identifier, failed count, timestamp of
the failure and timestamp of last attempt, and do a check before allowing a
login and a reset on a success.