How can I implement incremental wait time for django axes? - django

Question

I'm looking to implement django axes for brute force protection for my application. I want to implement something like this "lockout for 5 minutes after 5 failed attempts, lockout for 10 minutes after another 5 attempts"
Seems like the example in the doc is more straightforward with a fixed wait time, so I want to know if it's possible to implement something like this.

Answer 1

Yes this is possible, but will require several items to setup.
models.py
from axes.models import AccessAttempt
from django.db import models
from django.utils.translation import gettext_lazy as _
class AccessAttemptAddons(models.Model):
accessattempt = models.OneToOneField(AccessAttempt, on_delete=models.CASCADE)
expiration_date = models.DateTimeField(_("Expiration Time"), auto_now_add=False)
This models.py file is located within my login app(directory: project_name/login/models.py). This will create a new table called login_accessattemptaddons and establishes a "one to one" relationship with Django Axes' AccessAttempt table. This is necessary so that each entry in the AccessAttempt table is associated with each entry in the AccessAttemptAddons table; thus, making the expiration_date column in AccessAttemptAddons an extension of the AccessAttempt table.
settings.py
AXES_FAILURE_LIMIT = 5
AXES_LOCK_OUT_AT_FAILURE = True
AXES_LOCK_OUT_BY_COMBINATION_USER_AND_IP = True
AXES_LOCKOUT_CALLABLE = "login.views.timeout"
In settings.py the AXES_FAILURE_LIMIT is set to 5, meaning after the 5th failure to login, AXES_LOCKOUT_CALLABLE executes. AXES_LOCKOUT_CALLABLE is set to "login.views.timeout." I am not sure if this is best practice, but the function to run after failure is located within my projects login app, views.py file, and in my views.py file, a method called "timeout."
views.py
import datetime
from axes.models import AccessAttempt
from django.contrib.auth import login, authenticate
from django.http import HttpResponseRedirect
from django.shortcuts import render
from django.urls import reverse
from django.views import View
from .models import AccessAttemptAddons
from .forms import LoginForm
class LoginView(View):
form = LoginForm
context = {"form": form}
base_page = "login/index.html"
auth_base_page = "login/index.auth.html"
def get(self, request):
""" returns the login app index page """
if(request.user.is_authenticated):
return render(request, self.auth_base_page, self.context)
else:
return render(request, self.base_page, self.context)
def post(self, request):
""" Handles logging the user in """
# passing the request to the form to access in our forms.py file
form_post = self.form(request.POST, request=request)
if(form_post.is_valid()):
email = form_post.cleaned_data["email"]
password = form_post.cleaned_data["password"]
user = authenticate(username=email, password=password)
login(request, user, backend="django.contrib.auth.backends.ModelBackend")
return HttpResponseRedirect(reverse("account:index"))
else:
errors = form_post.non_field_errors()
context = {"form": form_post, "errors": errors}
return render(request, self.base_page, context)
def timeout(request):
try:
loginview = LoginView()
username = request.POST.get("email")
ip_address = request.axes_ip_address
account = AccessAttempt.objects.filter(username=username).filter(ip_address=ip_address)
current_time = datetime.datetime.now()
number_of_attempts = account.failures_since_start
threshold = (number_of_attempts / 5) * 5
form = LoginForm(request.POST)
error = f"Access attempts exceeded. Please wait {threshold} minutes"
base_page = "login/index.html"
context = {"form": form, "errors": error}
result = AccessAttempt.objects.raw(
'''
SELECT axes_accessattempt.id, login_accessattemptaddons.expiration_date
FROM axes_accessattempt
INNER JOIN login_accessattemptaddons
ON axes_accessattempt.id = login_accessattemptaddons.accessattempt_id
WHERE axes_accessattempt.username = %s and axes_accessattempt.ip_address = %s
''', [username, ip_address]
)[0]
if(current_time < result.expiration_date):
return render(request, base_page, context)
else:
account.delete()
account_page = loginview.post(request)
return account_page
except IndexError:
expiration_date = current_time + datetime.timedelta(minutes=threshold)
id = AccessAttempt.objects.filter(username=username, ip_address=ip_address)[0].id
addons = AccessAttemptAddons(expiration_date=expiration_date, accessattempt_id=id)
addons.save()
return render(request, base_page, context)
This is a copy of my views.py(directory: project_name/login/views.py). Starting with the timeout method, note that the threshold formula is the number of attempts divided by 5 then the result is multiplied by 5. Example: (10 failed attempts / 5 ) * 5min = 10min timeout. For attempts non divisible by 5(11, 12, .. 14) they are rounded down to 10min lockout. For 15 failed attempts to 19 failed attempts, the lockout time would be 15min.
Continuing with the code, the AccessAttempt table and AccessAttemptAddons table is joined on the one to one field "accessattempt_id." This creates a resultant table where expiration_date information for each related AccessAttempt id can be obtained. If there are no entries for the current failed attempt(brand new account lockout) then an index error occurs. The error is caught and creates a new expiration entry in the AccessAttemptAddons table with the formula above. On any subsequent attempts, the raw sql will pass without index failures because there is now an existing expiration_date entry.
This leads to the the if statement blocks to check to see if the account is ready to be unlocked or return an error page back to the user. If the current time is less than the expiration_date entry within the result table, then return a page with the error message. If the current time is greater, it means that enough time has passed to retry logging into the account. The request is handed off to the login view "post" method. Any failures after this repeats the timeout method steps.
Closing remarks
The timeout method in the views.py is what is necessary; how the request is handled after the lockout expires is up to the developer. I only showed how I handled it with a class based login view.