Htykuut

I am currently developing a system. I already done in my login module but I want to put some login attempts. The user will only have 3 attempts to login, if it exceed to 3 limits either the email of that user will be deactivated or it will give a 5 minutes penalty.

I don't know how to begin with it but the things I know that; you need to get the ip address of the user, check the number of attempts with that email.

User table

name (varchar)

email (varchar)

password (varchar)

confirm password (varchar)

attempts (int)

ip_address (varchar) 

status (varchar)

Controller

public function login()

{

         if($this->form_validation->run('login_validate') == FALSE) 

    {



        echo json_encode(validation_errors());

    } 

    else 

    {

        $email = clean_data($this->input->post('email'));

        $password = clean_data($this->input->post('password'));

        $where = array('email'=>$email);

        $get_user = $this->Crud_model->fetch_tag_row('*','users',$where);



        if($get_user) 

        {

            $check_password = $get_user->password;



            if($this->session->tempdata('penalty'))

            {

                echo json_encode("Your account is ". $_SESSION['penalty']. " on penalty");



            } 

            else 

            {

                if(password_verify($password,$check_password)) 

                {



                    if($get_user->status == 'Active') 

                    {

                            $user_session = [

                            'id'            => $get_user->id,

                            'first_name'    => $get_user->first_name,

                            'middle_name'   => $get_user->middle_name,

                            'last_name'     => $get_user->last_name,

                            'email'         => $get_user->email,

                            ];



                            $this->session->set_userdata('logged_in',$user_session);

                            $session = $this->session->userdata('logged_in');                  

                            $this->session->user_id          = $session['id'];

                            $this->session->email       = $session['email'];

                            $this->session->fullname    = $session['first_name'] .' '. $session['middle_name'] .' '. $session['last_name'];

                            echo json_encode("success");

                    }

                    else if ($get_user->status == 'Inactive')

                    {

                    echo json_encode("Your account is inactive. Contact our human resource department regarding this problem.");

                    }



                }

                else 

                {

                    $attempt = $this->session->userdata('attempt');

                    $attempt++;

                    $this->session->set_userdata('attempt', $attempt);



                    if($attempt == 3)

                    {

                        echo json_encode("Your account is locked");



                        $this->session->set_tempdata('penalty', true, 10);

                        $this->session->set_userdata('attempt', 0);



                    }

                    else

                    {

                        echo json_encode("Invalid Credentials");

                    }



                }

            }     

        }

        else

        {

            echo json_encode("Invalid Credentials");

        } 

    }

}

NOTE: Above is my login function. It's working properly(my validations for fields, if account existing, username and password correct etc.).Fetch->tag->row will only get the specific row

Question: Can anyone enlighten or guide me how to make an login attempt?

I dont think you need to use the IP, what if you use a session variable?

for example, when opening the login page the sess var will be set to 0, and on each error you increase it by one.

also, before to validate the user and pass you check the sess var if it is less or equal to 3, if it is then you give the message that they need to wait, if not you process the login.

Now, if what you want is to implement a 5 min penalty before trying again, you can use tempdata in session var, if the temp data is set to true it is still in penalty time, if not, you can process the login.

you can refer to Here

public function login() {

    if ($this->form_validation->run('login_validate') == FALSE) {

        echo json_encode(validation_errors());

    } else {

        $email = $this->input->post('email');

        $password = $this->input->post('password');

        $where = array('email' => $email);

        $get_user = $this->Crud_model->fetch_tag_row('*', 'users', $where);



        if ($get_user) {

            $check_password = $get_user->password;

            if($this->session->tempdata('penalty')){

                //Shows code that user is on a penalty

            }else{

                if (password_verify($password, $check_password)) {



                    if ($get_user->status == 'Active') {

                        $user_session = ['id' => $get_user->id, 'first_name' => $get_user->first_name, 'middle_name' => $get_user->middle_name, 'last_name' => $get_user->last_name, 'email' => $get_user->email,];



                        $this->session->set_userdata('logged_in', $user_session);

                        $session = $this->session->userdata('logged_in');

                        $this->session->user_id = $session['id'];

                        $this->session->email = $session['email'];

                        $this->session->fullname = $session['first_name'] . ' ' . $session['middle_name'] . ' ' . $session['last_name'];

                        echo json_encode("success");

                    } elseif ($get_user->status == 'Inactive') {

                        echo json_encode("Your account is inactive.");

                    }



                } else {

                    $attempt = $this->session->userdata('attempt');

                    $attempt++;

                    $this->session->set_userdata('attempt', $attempt);



                    if ($attempt == 3) {

                        echo json_encode("Your account is locked");

                        $this->db->set('attempts', 'attempts+120', FALSE);

                        $this->db->where($where);

                        $this->db->update('users'); // gives UPDATE mytable SET field = field+1 WHERE id = 2

                        $attempt = 0;



                        //code for setting tempdata when reached maximun tries

                        $this->session->set_tempdata('penalty', true, 300); //set the name of the sess var to 'penalty, the value will be true and will expire within 5 minutes (expressed in sec.)





                    } else {

                        echo json_encode("Invalid Credentials");

                    }

                }

            }



        } else {

            echo json_encode("No account found");

        }

    }

} 

hope it works