note 107277 deleted from function.sleep by danbrown
| From: | danbrown@php.net | Date: | Thu, 10 May 2012 21:31:49 +0000 |
| Subject: | note 107277 deleted from function.sleep by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-187903@lists.php.net to get a copy of this message | ||
Note Submitter: cyril dot garsaud at gmail dot com
----
@Barlow: Nope, the attacker could still send a big ammount of POST requests and one of them may
work. What we need to do is slow down his session until he succeeds.
<?php
session_start();
if(isset($_SESSION['failed']))
sleep(2);
public function handle_login() {
if($uid = user::check_password($_REQUEST['email'], $_REQUEST['password'])) {
session_destroy();
return self::authenticate_user($uid);
}
else {
$_SESSION['failed'] = 1;
return self::login_failed();
}
}
?>