php three password attempts

[jefargrafx]

I've been looking for an example of how to keep a user from login in after three failed password attempts.

I've found a few couple examples in javascript, but I'd rather do this with PHP?

anyone ever do this before or could you point me in the direction of a good tutorial......

thanks

jef

 

[cdlvj]

You can use the Apache directives to do this, and set the limit for logons.

 

[Bastien]

It's relatively simple and not so simple:

You need a way to id the user attempting the login - usually IP is enough, but as most people are on dial-up, re-connecting to their ISP will likely, but not always give a new IP.

Solution: Use a cookie in combination with an IP check. Place the 'NoLog' cookie on the client machine (still not fool-proof as it can be deleted) and when the third login attempt fails write a cookie to the machine and track the IP in some way (DB or flat file). For users with high speed fixed links, this is not an issue as the IP usually doesn't change with each internet connection.

Note: you probably also want to write a script to release this lock (using a date-stamp in the cookie and the db) to re-allow that user another kick at the can the next day or after some set time has elapsed.

There really is no fool-proof method of restricting the number of times a user can attempt to access the site. Its simply the nature of the web. The best attempt at control is described above.

HT

Bastien

Any one have a techie job in Toronto, I need to work...being laid off sucks!

 

[cdlvj]

Not sure reply to your question is correct, but here may be some info that may be helpfull.

How do I set up Apache to require a username and password to access certain documents?
There are several ways to do this; some of the more popular ones are to use the mod_auth, mod_auth_db, or mod_auth_dbm modules.

For an explanation on how to implement these restrictions, see Apache Week's articles on Using User Authentication or DBM User Authentication, or see the authentication tutorial in the Apache documentation.