Brute-Force & Credential Stuffing Defenses: Account Lockout & CAPTCHA

Credential stuffing uses billions of leaked username/password combinations to breach accounts. Defenses combine Exponential IP Rate Limiting, Account Lockout with email unlock tokens, and Adaptive CAPTCHAs.

// Redis Sliding Window Failed Login Limiter:
async function recordFailedLogin(email: string, ip: string): Promise<boolean> {
  const emailKey = `failed:email:${email}`;
  const ipKey = `failed:ip:${ip}`;
  
  const attempts = await redis.incr(emailKey);
  if (attempts === 1) await redis.expire(emailKey, 900); // 15 min window
  
  if (attempts >= 5) {
    // Lock account & require password reset:
    await lockAccountAndSendEmail(email);
    return true; // Account Locked!
  }
  return false;
}