static bool BruteForcePreventionCheck(string username, FailedLoginInfo failedLoginInfo)
{
if (failedLoginInfo == null)
{
return(true);
}
var now = DateTime.Now;
/* If a user tries to login quicker that 500ms from previous attempt - it is failed automatically */
lock (failedLoginInfo)
{
if (now - failedLoginInfo.LastLoginAttempt < MinimalTimeBetweenLoginAttempts)
{
return(false);
}
if (failedLoginInfo.LoginAttemptCount > BruteForcePrevention_MaximumLoginAttempts)
{
if (now - failedLoginInfo.LastLoginAttempt < HalfAnHour)
{
// User is "locked" for 30 minutes after 30 failed logins in a row
return(false);
}
// After half an hour - cleaning up the history
FailedLoginInfo temp;
_loginHistory.TryRemove(username, out temp);
}
}
return(true);
}
private static void UpdateLoginHistory(string username, bool loginIsValid, FailedLoginInfo failedLoginInfo)
{
if (loginIsValid)
{
_loginHistory.TryRemove(username, out failedLoginInfo);
return;
}
if (failedLoginInfo != null)
{
failedLoginInfo.LastLoginAttempt = DateTime.Now;
lock (failedLoginInfo)
{
failedLoginInfo.LoginAttemptCount++;
}
return;
}
_loginHistory[username] = new FailedLoginInfo {
LastLoginAttempt = DateTime.Now, LoginAttemptCount = 1
};
}
private static void UpdateLoginHistory(string username, bool loginIsValid, FailedLoginInfo failedLoginInfo)
{
if(loginIsValid)
{
_loginHistory.TryRemove(username, out failedLoginInfo);
return;
}
if(failedLoginInfo != null)
{
failedLoginInfo.LastLoginAttempt = DateTime.Now;
lock(failedLoginInfo)
{
failedLoginInfo.LoginAttemptCount++;
}
return;
}
_loginHistory[username] = new FailedLoginInfo {LastLoginAttempt = DateTime.Now, LoginAttemptCount = 1};
}
static bool BruteForcePreventionCheck(string username, FailedLoginInfo failedLoginInfo)
{
if (failedLoginInfo == null)
{
return true;
}
var now = DateTime.Now;
/* If a user tries to login quicker that 500ms from previous attempt - it is failed automatically */
lock (failedLoginInfo)
{
if (now - failedLoginInfo.LastLoginAttempt < MinimalTimeBetweenLoginAttempts)
{
return false;
}
if (failedLoginInfo.LoginAttemptCount > BruteForcePrevention_MaximumLoginAttempts)
{
if (now - failedLoginInfo.LastLoginAttempt < HalfAnHour)
{
// User is "locked" for 30 minutes after 30 failed logins in a row
return false;
}
// After half an hour - cleaning up the history
FailedLoginInfo temp;
_loginHistory.TryRemove(username, out temp);
}
}
return true;
}