Prevent the entering of users that have entered the wrong password more than 3 times
<p>I want to prevent entering of the users that have entered their password more than three times. I save their IP in session and set time-out for one minute. I don't know if this solution is good or not but there is a problem when wrong password is entered for three times. The code works correctly but, when the session times out, if I don't refresh the page it's not work. The user should be able to try again, but if I refresh it, the user can try again. What's the problem?</p>

<p>Here is my code...</p>

<pre><code> if (olduser.Trim() == username.Trim() &amp;&amp; password.Trim()==oldpass.Trim())
        { retval =olduser;
        HttpContext context = HttpContext.Current;
        context.Session[retval.ToString()] = retval.ToString();
       }
        else
        { 
            string ip = HttpContext.Current.Request.UserHostAddress;
           HttpContext failuser = HttpContext.Current;
           failuser.Session.Timeout =1;
           if (failuser.Session[ip] != null)
               failuser.Session[ip] = (int)failuser.Session[ip] + 1;
           else
               failuser.Session[ip] = 1;
               retval = failuser.Session[ip].ToString();
               if((int)failuser.Session[ip]&gt;2)
                retval = "!";                                 
        }

        return retval;
    }
</code></pre>
