Missing Brute Force Protection

Missing Brute Force Protection

Overview

Authentication endpoints without rate limiting allow attackers to make unlimited login attempts, enabling:

• Credential stuffing: Testing breached username/password combinations
• Password spraying: Testing common passwords across many accounts
• Dictionary attacks: Exhaustively guessing passwords

Detection Strategy

Identify login/authentication route handlers that do not implement:

• Rate limiting middleware (express-rate-limit, Flask-Limiter, etc.)
• Account lockout after N failed attempts
• CAPTCHA verification

Remediation

• Add rate limiting to all authentication endpoints (e.g., 5 attempts per 15 minutes per IP)
• Implement progressive delays or account lockout after repeated failures
• Consider CAPTCHA for high-value applications
• Use fail2ban or similar at the infrastructure level

Safe (Express.js):

const rateLimit = require('express-rate-limit');
const loginLimiter = rateLimit({
    windowMs: 15 * 60 * 1000,
    max: 5,
    message: 'Too many login attempts'
});
app.post('/login', loginLimiter, loginHandler);