Does account lockout on failed authentication attempts only resets on password reset or after the action duration?
-
Our account settings looks like:
- Failed attempts: 10
- Time period: 60s
- Action duration: 15m
Scenario:
- Did 4 failed login attempts
- 1 successful login attempt
- Tried 5 failed login attempts -> Account is locked
Can you clarify how the lockout works?
- Is there a 60-second Window or persistent counter?
- Does it not reset on successful login?
-
Hi @john-bantoto,
Welcome to FusionAuth!
Are you using this lockout configuration?
In that case, the answer to your question is:
- it is a time based solution. The time period is "The window of time in seconds for which the failed authentication attempts are counted. If no further failed attempts occur the failure count will be reset after this time period starting at the time of the last failed login."
- it does not get reset on successful login. Once the action is applied, it will remain applied for its configured duration (15 min in your case).
Hope this helps.
