Skip to content

Bug: AccessTokens authenticator records all accesses to "Auth Token Login Attempts" table #815

@kenjis

Description

@kenjis

Now that I'm thinking through this more, I don't know that access tokens or JWT really need to be tracked every page view anyway. Tracking login attempts is more for catching bad actors attempting to break into accounts. With PAT and JWT, I don't believe you typically see these same types of attacks, so rapidly expanding a database to very large sizes doesn't seem beneficial.
#195 (comment)

if (! $result->isOK()) {
// Always record a login attempt, whether success or not.
$this->loginModel->recordLoginAttempt(
self::ID_TYPE_ACCESS_TOKEN,
$credentials['token'] ?? '',
false,
$ipAddress,
$userAgent
);
return $result;
}

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions