Brute Force Protection

Brute force protection encompasses multiple defensive layers designed to detect and mitigate automated attacks that attempt to guess valid credentials through systematic trial. These attacks include simple brute force (trying all possible combinations), dictionary attacks (trying common passwords), credential stuffing (using breached username/password pairs from other services), and password spraying (trying a few common passwords across many accounts to avoid lockout thresholds).

Effective protection requires a layered approach that combines multiple mechanisms: per-account rate limiting (progressive delays and lockout), per-IP rate limiting (blocking IPs with excessive failed attempts across any account), global rate limiting (capping total authentication requests per time window), CAPTCHA challenges (triggered after initial failures), device fingerprinting (flagging requests from known attack tools), and geographic anomaly detection (flagging login attempts from unusual locations). No single mechanism is sufficient -- credential stuffing can use millions of unique IP addresses, and password spraying specifically targets per-account limits.

Implementation typically uses Redis or a similar in-memory store for real-time tracking of attempt patterns. Key metrics to track include failed attempts per account, failed attempts per IP, failed attempts per IP subnet (/24), and the ratio of failed to successful authentications globally. Integrate with threat intelligence feeds (IP reputation databases, Tor exit node lists, known botnet IPs) to proactively block suspicious sources. Use WAF rules to detect and block automated tools based on request patterns, headers, and TLS fingerprinting. Monitor for distributed attacks where each IP makes only a few attempts but the aggregate pattern indicates credential stuffing.