title: Throttling login attempts
body: <p>(This is in principal a language-agnostic question, though in my case I am using ASP.NET 3.5)</p>
  
  <p>I am using the standard ASP.NET <a href="http://msdn.microsoft.com/en-us/library/system.web.ui.webcontrols.login.aspx" rel="noreferrer">login control</a> and would like to implement the following failed login attempt throttling logic.</p>
  
  <ul>
  <li>Handle the <a href="http://msdn.microsoft.com/en-us/library/system.web.ui.webcontrols.login.loginerror.aspx" rel="noreferrer"><code>OnLoginError</code></a> event and maintain, in <a href="http://msdn.microsoft.com/en-us/library/ms972429.aspx" rel="noreferrer">Session</a>, a count of failed login attempts</li>
  <li>When this count gets to <em>[some configurable value]</em> block further login attempts from the originating IP address or for that user / those users for 1 hour</li>
  </ul>
  
  <p>Does this sound like a sensible approach? Am I missing an obvious means by which such checks could be bypassed?</p>
  
  <p>Note: ASP.NET Session is associated with the user's browser using a cookie</p>
  
  <h2>Edit</h2>
  
  <p>This is for an administration site that is only going to be used from the UK and India</p>