<p dir="auto">Set user lockout after X amount of failed logins to protect against bruteforce attacks.</p>
<ul dir="auto">
<li>Feature toggle in config</li>
<li>Configurable number of logins in config</li>
<li>Admin can reset user (Is Active true/false)</li>
<li>Email recovery link</li>
</ul>
<p dir="auto"><strong>Is your feature request related to a problem? Please describe.</strong><br>
In its default state, the Superset login page permits any number of failed login attempts. This has been flagged as a security issue by our sysadmin team, and I agree with them. I have only tested users created in the database and have not tried other authentication methods.</p>
<p dir="auto"><strong>Describe the solution you'd like</strong><br>
The login page should permit, say, 3 incorrect login attempts and should ask the user to try again after a period of time. This time should be customizable from the config file.</p>
<p dir="auto"><strong>Describe alternatives you've considered</strong><br>
I am not sure if this already works for other authentication methods.</p>
<p dir="auto"><strong>Additional context</strong><br>
None.</p>