Attempt Component

A simple component to protect sensitive actions from brute force attacks.

API

count($action)

Returns the number of failed attempts for a certain action.

limit($action, $limit = 5)

Returns false if the number of failed attempts is bigger than the passed limit.

fail($action, $duration = '+10 minutes')

Creates a failed attempt that counts towards the limit for the passed duration

reset($action)

Deletes all failed attempts for a certain action

cleanup()

Deletes all expired failed attempts from the database. This should be run via CakeShell (ideally as a CRON job) every now and then.

Schema

CREATE TABLE `attempts` (
  `id` char(36) NOT NULL DEFAULT '',
  `ip` varchar(64) DEFAULT NULL,
  `action` varchar(32) DEFAULT NULL,
  `created` datetime DEFAULT NULL,
  `expires` datetime DEFAULT NULL,
  PRIMARY KEY (`id`),
  KEY `ip` (`ip`,`action`),
  KEY `expires` (`expires`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8

Example Implementation

class ExampleController extends Controller {
	
	var $components = array(
		'Attempt'
		);
	
	var $loginAttemptLimit = 10;
	var $loginAttemptDuration = '+1 hour';
	
	public function login() {
		// Form submitted?
		if ( $formSubmitted = true ) {
			// All required fields entered?
			if ( $validFormData = true ) {
				// Limit to 10 failed attempts
				if ( $this->Attempt->limit('login', $this->loginAttemptLimit) ) {
					// Validate user credentials
					if ( $validCredentials = true ) {
						// Log user in
					} else {
						// Invalid credentials, count as failed attempt for an hour
						$this->Attempt->fail('login', $this->loginAttemptDuration);
						$this->Session->setFlash('Unknown user or wrong password');
					}
				} else {
					// User exceeded attempt limit
					// Ideally show a CAPTCHA (ensuring this is not a robot 
					// without blocking out and frustrating users),
					// otherwise show error message
					$this->Session->setFlash('Too many failed attempts!');
				}
			} else {
				// Invalid form data but keep it ambiguous
				$this->Session->setFlash('Unknown user or wrong password');
			}
		}
	}
}