How does Kirby 2.2 bruteforce protection work?

Kirby 2 Solved ✅
1

How does Kirby 2.2 bruteforce protection work?

2

The protection is implemented in the Login class. If a specific visitor (meaning a specific IP address) tries to login more than 10 times within the log expiry time (one hour) without success, he/she is blocked. The logs also expire on successful login by that visitor.

2 Likes
3

There are two additional layers of protection:

  • Cross site request forgery protection via a token stored in the session and submitted with the form. You cannot directly post the login form from another server. You have to write a script, which fills in the form and submits it.

  • Random response delays after wrong credentials have been entered. This is an additional recommendation by OWASP. By adding a random delay up to three seconds when you enter the wrong login details, a script that runs a bruteforce attack will take significantly longer to find the right combination of username and password. For the user the delay doesn’t really matter that much, but the attacker will hate it.

2 Likes