34
loading...
ASP.NET Core Identity User Locked out
The user lockout feature is the way to improve application security by locking out a user that enters a password incorrectly several times. This technique can help us in protecting against brute force attacks, where an attacker repeatedly tries to guess a password. ⛳
Quite a basic feature for an authentication service, but adding it in my Web API app was quite a head scratcher.
In your startup.cs or container configuration file, the config for locking out can be set.
services.AddIdentity<User, IdentityRole>(opt =>
{
// previous code removed for clarity reasons
opt.Lockout.AllowedForNewUsers = true;
opt.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(2);
opt.Lockout.MaxFailedAccessAttempts = 3;
})The property names are self explanatory here.
The above code will by default setup locking out feature and if a person is trying to login with wrong
password for a given username the user account will be locked out for 5 minutes updated accordingly in LockoutEnd column // AuthService.cs
..
var result = await signInManager.CheckPasswordSignInAsync(user, model.Password, lockoutOnFailure: true);
..The properties of
result : SignInResult we are concerned here are Succeeded, IsLockedOut.✅
Succeeded == true if the username and password match❌
Succeeded == false if the username and password do not match✅
IsLockedOut == true if this user has been locked out after x number of trialsI was expecting
LockOutEnabled will become true (1) in the identity user table. It took me few hours to get to the documentation but it was stated clearly in the Library class.// Microsoft.AspNetCore.Identity.IdentityUser
// Gets or sets a flag indicating if the user could be locked out.
public virtual bool LockoutEnabled { get; set; }I missed the could be and it costed me some hours.😪
Updating this column to
true for necessary users then locks out the user for particular a time limit set in the configThe proper logging and an error can be thrown with
result.IsLockedOut flag from the service layer 😅📚 References
34