Rate Limit Password Inputs

In this guide, we'll explore how to set up a rate-limiting feature for password attempts in Xano. This feature suspends users from logging in for a specified duration if they exceed a certain number of failed login attempts within a given time frame. It helps prevent brute-force attacks and reduces server load from excessive invalid requests.

Step 1: Create a Login Attempts Table

Start by creating a table called `login_attempts` to log all login attempts. This table should have the following columns:

• `user_id` (reference to the user table)
• `success` (boolean indicating whether the login attempt was successful or not)
• `created_at` (timestamp of the login attempt)

Additionally, add two columns to your `users` table:

• `temp_suspension` (boolean indicating if the user is currently suspended)
• `temp_timeout_end` (timestamp of when the suspension period ends)

Step 2: Update the Login Endpoint

In your `auth/login` endpoint, modify the logic to log each login attempt in the `login_attempts` table. Add a record with the `user_id` and `success` (set to `true` for successful logins and `false` for failed attempts).

Step 3: Create a Trigger

Next, create a trigger that checks for failed login attempts within a specific time frame (e.g., 5 attempts in the last 60 seconds). If the condition is met and the user is not already suspended, update the `users` table to set `temp_suspension` to `true` and `temp_timeout_end` to the current timestamp plus a specified duration (e.g., 60 seconds).

1. Go to your `login_attempts` table and click the three dots in the top-right corner, then select "Triggers" and "Add Database Trigger."
2. Name the trigger "rate_limit_password_attempts" and set the action to "Insert."
3. Add a query to count the number of failed login attempts for the user within the last 60 seconds:

1. Check if the count is greater than or equal to 5 (or your chosen threshold) and if the user is not already suspended:

This suspends the user for 60 seconds after the threshold is reached.

Step 4: Create Pre-Middleware

To prevent suspended users from making further login attempts, create pre-middleware that checks the user's suspension status before executing the login endpoint logic.

1. Go to the "Library" section and click "Add Middleware."
2. Name the middleware "rate_limit_password_attempts" and set the response type to "Replace Exception Critical and Safe."
3. In the middleware function, retrieve the user record based on the provided email:

1. Add a precondition to check if the user is not suspended:

1. Attach the pre-middleware to your `auth/login` endpoint by going to the endpoint settings, clicking "Customize" under "Middleware," and adding the pre-middleware you just created.

Step 5: Create a Background Task

Finally, create a background task to automatically unsuspend users after the timeout period has expired.

1. Go to the "Background Tasks" section and click "Add Background Task."
2. Name the task "rate_limit_password_attempts."
3. Query all users where `temp_suspension` is `true` and `temp_timeout_end` is less than the current time:

1. Loop through the retrieved users and update their `temp_suspension` to `false` and `temp_timeout_end` to `null`:

1. Set the task to run every 10 seconds (or your desired interval) and enable it.

With these steps completed, your Xano application now has a rate-limiting feature for password attempts, improving security and preventing potential brute-force attacks.