Meteor，跟踪用户登录失败的尝试，并禁止他们在x次尝试后登录

Question

I am trying to prevent a user from logging in after 3 failed attempts when they provide the right username or email and wrong password.

Accounts.validateLoginAttempt(function(info){
    var user = info.user;
    var failAttemp = user.profile.loginFaileAttempt;
    if(failAttemp == 3){
        console.log('you need to contact the admin!')
        return false;
    }else{

        if(Meteor.Error == 'Incorrect password '){
            // incremnt the fail attempts
            failAttemp++;
            console.log(failAttemp);
        }
    }

    return true;
    // success login set to 0 
    failAttemp = 0;

});

but it is not working , what am I doing wrong and is there any Meteor way of doing this?

Thanks.

Answer 1

The failed attempt count is not updated in the users collection in your code. And that last line failAttemp = 0; will never be executed because the function has already returned.

Further, I see some issues that you might want to fix: Meteor.Error is not the proper way to check for incorrect passwords entered. It will be undefined and even more it would not trigger because of the extra space in 'Incorrect password '. Use the error object that comes in with the info parameter and use the error code instead of the message.

Login attempts from unregistered users get passed to Accounts.validateLoginAttempt anyway. The info.user will be empty in such attempts. Besides this, it's best to check for existence of the profile field is the user object.

When a user has 3 failed attempts and tries for the 4th time, he is not informed about what is wrong. He still sees 'Incorrect password' and in the console on the server it shows 'you need to contact the admin!'. You can throw a Meteor.Error with a more informative message.

When a user has 3 failed attempts he will be staying in the 'disabled' state. By this I mean he can not login anymore even if he remembers his correct password. First check whether the attempt is forbidden, then check the number of failed attempts.

When a user enters the correct password after a failed attempt, the failed attempt count should return to 0, at least that's what I think you'll want looking at your code (last unreachable code line).

Here is an example of a solution that will:

• Save failed attempts.
• Performs a check based on error code rather than message.
• Has a informative message after 3 failed attempts.
• Handles unregistered users properly.
• Lets the user login after failed attempts if they remember their password.
• Reset the failed attempt count after successful login.

Code:

Accounts.validateLoginAttempt(function(info){
    var user = info.user;
    if (!user)
        return false;

    var failAttempt = 0;
    if (user.profile)
        failAttempt = user.profile.loginFaileAttempt;

    var loginAllowed = false;
    if(info.error && info.error.error == 403){
        if(failAttempt >= 3) {
            console.log('you need to contact the admin!');
            throw new Meteor.Error(403, 'you need to contact the admin!');
        }
        // increment the fail attempts
        failAttempt++;
        console.log(failAttempt);
        loginAllowed = false;
    } else {
        // success login set to 0
        failAttempt = 0;
        loginAllowed = true;
    }

    Meteor.users.update({_id: user._id}, {$set: {'profile.loginFaileAttempt': failAttempt}});

    return loginAllowed;
});