0

Scenario: a user enters his password incorrectly x times, so his account is locked for y minutes.

Should I revoke all his refresh tokens?

Problems:

  • user is logged out of all devices, not just the one he's on currently (where he entered the wrong password)
  • attacker can log out any user (from all devices)
  • poor UX

The alternative is to do nothing: when the lockout expires, the user must login again on that device. He'll still be logged in on all his other devices.

What other considerations are there? Also, does anyone know what major web services commonly do?

Improve this question

2 Answers 2

Reset to default
2

The answer is easy, please don't do this, otherwise this would be a built-in denial-of service.

If an attacker knows a user name it would be possible to run a script that every x minutes performs a set of requests using an arbitrary password just to trigger this function which erases all the user's refresh tokens.

This would log-off the user every time form all devices, this would be a low-effort denial of service against that user.

I would just block new password based login attempts for the affected user may be even restricted to the IP address (-range) the attack came from.

Improve this answer
1
  • That's my feeling too. It's disconcerting that there are situations where you know something is probably due to malicious activity, but the best approach is to do nothing so as to avoid unintended consequences.
    – lonix
    Mar 16 at 4:06
0

Another strategy: block the IP address for a failed login attempt (for x minutes).

Unless that user is up to no good, there's no reason that IP address should be communicating with your service anytime soon, because it represents a blocked user.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.