Managing User Lockout and Security Policies

Configure account lockout thresholds to prevent brute-force attacks on application endpoints.

In this lesson, you will learn how to defend your application against brute-force attacks by programmatically configuring account lockout thresholds within ASP.NET Core Identity.

Why Lockout Policies Matter

A brute-force attack involves an automated script attempting to guess user passwords by trying thousands of combinations in a short time. If your application doesn't restrict these attempts, an attacker might eventually succeed. By implementing a lockout policy, you force the system to temporarily block an account after a specified number of failed sign-in attempts, effectively neutralizing the attack vector.

Configuring the Policy

In ASP.NET Core, these security policies are defined during the initial configuration of your Identity services in the Program.cs file. You modify the Lockout options within the AddIdentity method to enforce strict rules for your users.

Here is how you set these thresholds:

builder.Services.AddIdentity<ApplicationUser, IdentityRole>(options =>
{
    // Enable lockout after 5 failed attempts
    options.Lockout.MaxFailedAccessAttempts = 5;
    
    // Keep the account locked for 15 minutes
    options.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(15);
    
    // Allow the system to lock out new users immediately
    options.Lockout.AllowedForNewUsers = true;
})
.AddEntityFrameworkStores<ApplicationDbContext>();

How It Works Behind the Scenes

When a user attempts to log in, Identity checks the AccessFailedCount property in the database. If this count reaches MaxFailedAccessAttempts, Identity sets a LockoutEnd timestamp. While this timestamp is in the future, the SignInManager will reject any subsequent login attempts for that user, regardless of whether the password provided is correct.

It is important to note that these settings should be balanced; if you set the threshold too low, legitimate users might be locked out due to simple typos. Conversely, setting it too high provides more opportunity for attackers to succeed. Most production systems use a threshold between 3 and 10 attempts to maintain a healthy balance between security and user experience.

Key Takeaway: By configuring MaxFailedAccessAttempts and DefaultLockoutTimeSpan, you create a critical security barrier that automatically throttles brute-force attempts and protects user accounts from unauthorized access.