title: How to correctly block IP adresses in Node.JS server app?
body: <p>Say I have a Node.JS server app and I want to block users that failed to log in 3 consecutive times, what is the correctly way to do that?</p>
  <p>Should I handle the blocking part in the server app, basically after the user has connected but has not yet logged in, or is there some lower level stage where I am supposed to do it, so it doesn't even reach my Node.JS app?</p>