What's the right way to block brute force of HTTP basic auth?

Question

Here's my thought,

Set a threshold like 30 times in a minute, then block this IP for a few minutes.

But If the attacker forge the source IP address, this could block legitimate user immediately.

And I'm confused now.

score 4 · Accepted Answer · edited Apr 13 '17 at 12:13

4

a common way to block brute forces on all types of services, including http basic auth is fail2ban. Bots can't forge a source IP address for a full TCP connection(in your case a HTTP request), you don't have to worry about that. (see Are IP addresses "trivial to forge"? )

edited Apr 13 '17 at 12:13

Community

1

answered Oct 12 '12 at 06:12

Gryphius

2,760
1
20
21

What's the right way to block brute force of HTTP basic auth?

1 Answers1