Seamless Meteor apps accounts protection from password brute-force attacks. Users won't notice it. Hackers shall not pass.
meteor add lucasantoniassi:accounts-lockout
// server
import { AccountsLockout } from 'meteor/lucasantoniassi:accounts-lockout';Default settings:
"knownUsers": {
"failuresBeforeLockout": 3, // positive integer greater than 0
"lockoutPeriod": 60, // in seconds
"failureWindow": 10 // in seconds
},
"unknownUsers": {
"failuresBeforeLockout": 3, // positive integer greater than 0
"lockoutPeriod": 60, // in seconds
"failureWindow": 10 // in seconds
}knownUsers are users where already belongs to your Meteor.users collections,
these rules are applied if they attempt to login with an incorrect password but a know email.
unknownUsers are users where not belongs to your Meteor.users collections,
these rules are applied if they attempt to login with a unknown email.
failuresBeforeLockout should be a positive integer greater than 0.
lockoutPeriod should be in seconds.
failureWindow should be in seconds.
If the default is nice to you, you can do that.
(new AccountsLockout()).startup();You can overwrite passing an object as argument.
(new AccountsLockout({
knownUsers: {
failuresBeforeLockout: 3,
lockoutPeriod: 60,
failureWindow: 15,
},
unknownUsers: {
failuresBeforeLockout: 3,
lockoutPeriod: 60,
failureWindow: 15,
},
})).startup();If you prefer, you can pass a function as argument.
const knownUsersRules = (user) => {
// apply some logic with this user
return {
failuresBeforeLockout,
lockoutPeriod,
failureWindow,
};
};
const unknownUsersRules = (connection) => {
// apply some logic with this connection
return {
failuresBeforeLockout,
lockoutPeriod,
failureWindow,
};
};
(new AccountsLockout({
knownUsers: knownUsersRules,
unknownUsers: unknownUsersRules,
})).startup();If you prefer, you can use Meteor.settings. It will overwrite any previous case.
"accounts-lockout": {
"knownUsers": {
"failuresBeforeLockout": 3,
"lockoutPeriod": 60,
"failureWindow": 10
},
"unknownUsers": {
"failuresBeforeLockout": 3,
"lockoutPeriod": 60,
"failureWindow": 10
}
}This package is open-sourced software licensed under the MIT license.