41man/login-gate-bundle

Checking brute force attacks on site

0.7.1 2019-05-12 10:09 UTC

Requires

• symfony/config: ^3.3|^4.0
• symfony/dependency-injection: ^3.3|^4.0
• symfony/security-bundle: ^3.3|^4.0

Requires (Dev)

• doctrine/doctrine-bundle: ^1.6.3
• doctrine/doctrine-fixtures-bundle: ^2.3
• doctrine/mongodb-odm: ~1.0
• doctrine/mongodb-odm-bundle: ~3.0
• doctrine/orm: ^2.5.4
• phpunit/phpunit: ^5.4
• symfony/browser-kit: ^3.3|^4.0
• symfony/css-selector: ^3.4
• symfony/form: ^3.3|^4.0
• symfony/templating: ^3.3|^4.0

MIT

• Aleksandr Klimenkov

• security
• brute-force

README

This bundle detects brute-force attacks on Symfony applications. It then will disable login for attackers for a certain period of time. This bundle also provides special events to execute custom handlers when a brute-force attack is detected.

Compatability

The bundle is since version 0.6 compatible with Symfony 4.

Installation

Add this bundle via Composer:

composer require anyx/login-gate-bundle

Configuration:

Add in app/config/config.yml:

login_gate:
    storages: ['orm'] # Attempts storages. Available storages: ['orm', 'session', 'mongodb']
    options:
        max_count_attempts: 3
        timeout: 600 #Ban period
        watch_period: 3600 #Only for databases storage. Period of actuality attempts

Register event handler (optional).

services:
      acme.brute_force_listener:
          class: Acme\BestBundle\Listener\BruteForceAttemptListener
          tags:
              - { name: kernel.event_listener, event: security.brute_force_attempt, method: onBruteForceAttempt }

Usage

In the following example we import the checker via dependency injection in SecurityController.php.

namespace App\Controller;

use Anyx\LoginGateBundle\Service\BruteForceChecker;

/**
 * @var BruteForceChecker $bruteForceChecker
 */
private $bruteForceChecker;

/**
 * SecurityController constructor.
 * @param BruteForceChecker $bruteForceChecker
 */
public function __construct(BruteForceChecker $bruteForceChecker)
{
    $this->bruteForceChecker = $bruteForceChecker;
}

We can now use the checker to see if a person is allowed to login.

$this->bruteForceChecker->canLogin($request)

We can also clear the loginattempts when a login is succesful.

$this->bruteForceChecker->getStorage()->clearCountAttempts($request);

For more examples take a look at the tests.