How can I limit login attempts in Spring Security?

Question

Is there some configuration or available module in Spring Security to limit login attempts (ideally, I'd like to have an increasing wait time between subsequent failed attempts)? If not, which part of the API should be used for this?

Answer 1

From Spring 4.2 upwards annotation based event listeners are available:

@Component public class AuthenticationEventListener {      @EventListener     public void authenticationFailed(AuthenticationFailureBadCredentialsEvent event) {          String username = (String) event.getAuthentication().getPrincipal();          // update the failed login count for the user         // ...     }  } 

Answer 2

Implement an AuthenticationFailureHandler that updates a count/time in the DB. I wouldn't count on using the session because the attacker is not going to be sending cookies anyway.