CODEWITHSUNDEEP
c#asp.net
quantum62
quantum62

Reputation: 153

Prevent the entering of users that have entered the wrong password more than 3 times

I want to prevent entering of the users that have entered their password more than three times. I save their IP in session and set time-out for one minute. I don't know if this solution is good or not but there is a problem when wrong password is entered for three times. The code works correctly but, when the session times out, if I don't refresh the page it's not work. The user should be able to try again, but if I refresh it, the user can try again. What's the problem?

Here is my code...

 if (olduser.Trim() == username.Trim() && password.Trim()==oldpass.Trim())
        { retval =olduser;
        HttpContext context = HttpContext.Current;
        context.Session[retval.ToString()] = retval.ToString();
       }
        else
        { 
            string ip = HttpContext.Current.Request.UserHostAddress;
           HttpContext failuser = HttpContext.Current;
           failuser.Session.Timeout =1;
           if (failuser.Session[ip] != null)
               failuser.Session[ip] = (int)failuser.Session[ip] + 1;
           else
               failuser.Session[ip] = 1;
               retval = failuser.Session[ip].ToString();
               if((int)failuser.Session[ip]>2)
                retval = "!";                                 
        }

        return retval;
    }

Upvotes: 0

Views: 687

Answers (2)

Nick Jones
Nick Jones

Reputation: 6493

If you use a membership provider you get this functionality for free:

Max Invalid Password Attempts

Upvotes: 0

Dennis Traub
Dennis Traub

Reputation: 51634

You're probably trying to reinvent the wheel. Consider using a built in ASP.NET Membership Provider.

Upvotes: 3

Related Questions