Only clear flood attempts when necessary during user login

Created on 21 December 2023, 6 months ago
Updated 5 January 2024, 6 months ago

Problem/Motivation

Discovered as part of πŸ› Flood database backend ::isAllowed() should call ::ensureTableExists() Fixed and via πŸ“Œ Add database query spans to otel traces Needs review .

When users log in, we clear previous flood attempts, however we do that whether there are any in the database to clear or not.

By checking Flood::isAllowed() with a limit of 1, we can check if the user has a clean slate, and if so skip clearing the flood attempts at all. This saves a DELETE query every user login, at the cost of an extra SELECT query if a user has already triggered a flood event for a failed login.

Steps to reproduce

Proposed resolution

Add an extra flag to form state if the user has a clean slate.

Adjust StandardPerformanceTest to reflect the lower number of database queries (!!!!).

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

Before:

After:

πŸ“Œ Task
Status

Fixed

Version

10.2 ✨

Component
User moduleΒ  β†’

Last updated about 17 hours ago

Created by

πŸ‡¬πŸ‡§United Kingdom catch

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Production build 0.69.0 2024