Cover of the book Symfony 5: The Fast Track

Symfony 5: The Fast Track is the best book to learn modern Symfony development, from zero to production. +300 pages showcasing Symfony with Docker, APIs, queues & async tasks, Webpack, SPAs, etc.

  1. Home
  2. Blog
  3. New in Symfony 5.2: Login Throttling

New in Symfony 5.2: Login Throttling

October 16, 2020 Avatar of Javier Eguiluz Javier Eguiluz

Contributed by
Wouter De Jong
in #38204.

A common brute-force attack against web applications consists of an attacker submitting a login form many times with the hope of eventually guessing the password of some user account.

One of the best countermeasures to these attacks is called “login throttling”, which denies a user from attempting logins after a certain number of failed attempts. Thanks to the recently added RateLimiter component, Symfony 5.2 will provide login throttling out of the box.

First, make sure that you are using the new Authenticator-based Security. Then, add the following configuration to your firewall:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
# config/packages/security.yaml
security:
    firewalls:
        default:
            # by default, the feature allows 5 login attempts per minute
            login_throttling: ~

            # configuring the maximum login attempts (per minute)
            login_throttling:
                max_attempts: 1

            # you can even use a custom rate limiter via its service ID
            login_throttling:
                limiter: app.my_login_rate_limiter

That’s all. Next time an attacker tries to make too many login attempts, your Symfony application will start blocking them.

Help the Symfony project!

As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

New in Symfony 5.2: Login Throttling symfony.com/blog/new-in-symfony-5-2-login-throttling

Tweet this

Comments

Wesley Abbenhuis said on Oct 16, 2020 #1

Finally, thanks Wouter

Sidi LEKHALIFA said on Oct 16, 2020 #2

Great!

Erwan Nader said on Oct 16, 2020 #3

Nice :)

Ait Benalla Oussama said on Oct 16, 2020 #4

That's What I'm Talking About

Thibault G. said on Oct 17, 2020 #5

Nice !

Art Hundiak said on Oct 17, 2020 #6

Surprised to see that the rather violent term, throttling, was approved by the PCRC (Politically Correct Review Committee).

Javier Eguiluz Certified said on Oct 17, 2020 #7

I'm not native in English, but "throttle" to me is a common English word (e.g. is one of the car pedals). I haven't seen this word associated with violence ever, but I might be wrong.

Ben Hakim said on Oct 18, 2020 #8

Amazing!! I love it !

Now wish for 2fa :)

Sylvain Combraque said on Dec 3, 2020 #9

Other soft do that better and faster than PHP

Comments are closed.

To ensure that comments stay relevant, they are closed for old posts.