How to add counter and limit on login attempts per user in Vaadin24

Flow
1

Hello!
We tried adding logic of counter of attempt into beforeEnter(BeforeEnterEvent event) method, but it works only before entering username and only on sessions.
We are using stand forms:

@AnonymousAllowed
@PageTitle("Login")
@Route(value = "login")
@RouteAlias(value = "")
public class LoginView extends LoginOverlay implements BeforeEnterObserver {


    private final AuthenticatedUser authenticatedUser;
    private String errorMessage;

    public LoginView(AuthenticatedUser authenticatedUser) {
        this.authenticatedUser = authenticatedUser;
        setAction(RouteUtil.getRoutePath(VaadinService.getCurrent().getContext(), getClass()));

        LoginI18n i18n = LoginI18n.createDefault();
        i18n.setHeader(new LoginI18n.Header());
        i18n.getHeader().setTitle("Guard");
        i18n.getHeader().setDescription("Enter login and pass");
        i18n.setAdditionalInformation(null);
        i18n.getForm().setTitle("Authorisation");
        i18n.getForm().setUsername("Login");
        i18n.getForm().setPassword("Pass");
        i18n.getForm().setSubmit("Enter");
        setI18n(i18n);

        setForgotPasswordButtonVisible(false);
        setOpened(true);
    }

    @Override
    public void beforeEnter(BeforeEnterEvent event) {
        if (authenticatedUser.get().isPresent()) {
            setOpened(false);
            UserEntity user = authenticatedUser.get().get();
            System.out.println("------- "+user.toString());
            if (user.getRole().equals(Role.ADMIN)) {
                event.forwardTo("admin");
            } else {
                event.forwardTo("home");
            }
        }
        setError(event.getLocation().getQueryParameters().getParameters().containsKey("error"));
1 Like
2

You can add a listener to the LoginView

this.addLoginListener(e → {System.out.println("Username "+e.getUsername());});

If it’s that you want, save it in a static HashMap <String,Integer>
If the integer < attmepts, do …

Be careful with memory. If someone try 1000000 usernames, you have to keep them in memory. So you can limit to the users of your web