we need to find a different approach for the sleep operatoin ...

[DeepDiver1975]

using sleep on the server side will not only block the user but also block the whole server infrastructure.

this could lead to a denial of service

@Peter-Prochaska what would be an appropriate solution here? THX

[karakayasemi]

Maybe we can check login attempts ip in preLogin, and if his attempts bigger than certain threshold we can directly return a ban response.

[DeepDiver1975]

wana give it a try?

[karakayasemi]

I am on it now.

[karakayasemi]

We can use same thing for 404s