Attack Protection

User Attack Protection provides a comprehensive security layer to safeguard user accounts from malicious activities, such as brute force attacks, bot intrusions, and unauthorized access attempts. Various security features enhance authentication processes' integrity and minimize potential threats.

Key Features

• Brute Force Protection

  Brute Force Lockout allows you to restrict account access based on the number of failed logins OR reset passwords by token/OTP attempts. If a user enters incorrect credentials ( username and password) in the Login API OR enters the incorrect token/ OTP and reaches the threshold limit set in the Admin Console, a Brute Force Lockout action will be triggered for further API calls.

• Breached Password Protection

  To enhance security, the system detects and prevents the usage of compromised passwords. If users' credentials are found in known breached password lists, the system prompts them to reset their password, ensuring higher account safety.

• Bot Protection

  Bot Protection adds an extra layer of security by dynamically triggering CAPTCHA challenges at various authentication stages. You can configure this by selecting multiple APIs in the Admin Console under the "Bot Protection Allowed On APIs" settings. This measure helps prevent automated bot attacks on user authentication flows.

• Domain Access Management

  Control registration access by whitelisting/blacklisting domain names and email IDs. This feature enables organizations to restrict access to certain users based on their domain, reducing the risk of unauthorized registrations and fraudulent account creation.

• IP Access Management

  Control and restrict API access by configuring allowlists and blocklists for specific IP addresses, IP ranges, or CIDR blocks (supporting both IPv4 and IPv6). This feature provides independent controls for Manage APIs and Auth APIs directly in the Admin Console, allowing organizations to safeguard sensitive administrative endpoints and protect end-user authentication flows from untrusted networks.

Use Cases

• Preventing Unauthorized Access Attempts

  Brute force protection ensures that if an attacker tries to guess a password through repeated attempts, the account gets locked after a defined threshold, mitigating unauthorized access.

• Protecting Users from Credential Stuffing Attacks

  Breached password protection ensures that users do not use compromised passwords, which attackers could exploit using credential-stuffing techniques.

• Blocking Automated Bot Attacks

  Bot protection prevents malicious automated scripts from bypassing authentication processes, ensuring that only legitimate users can gain access.

• Restricting Access Based on Organizational Policies

  Domain access management allows enterprises to restrict sign-ups to specific domains (e.g., corporate emails only), preventing unauthorized or fraudulent registrations.

• Restricting API Traffic to Trusted Networks and Mitigating Threats

  IP Access Management allows organizations to enforce independent allowlists and blocklists across Manage and Auth APIs. This enables teams to restrict administrative operations and backend integrations strictly to verified corporate VPNs, office gateways, or static server IPs, while actively blocking malicious IP ranges, botnets, and suspect subnets from reaching user authentication endpoints.

By leveraging these security measures, User Attack Protection strengthens authentication mechanisms, reduces security risks, and enhances overall user account security.

Configuration

Brute Force Lockout

Brute Force Lockout prevents unauthorized access by restricting account access after multiple failed login or password reset attempts. If a user exceeds the threshold set in the Admin Console, their account may be locked, suspended, or challenged with CAPTCHA or security questions, depending on the selected lockout type. The system then updates the user's profile with the lockout status.

Configuration Steps:

1. Navigate to Brute Force Lockout in the Admin console.
2. Set the threshold for failed login attempts.
3. Define the lockout type and duration.
4. Save the settings.

This section provides detailed information on Brute Force Lockout customization and configuration.

Breached Password Protection

This feature prevents users from using passwords exposed in known data breaches, ensuring account security and providing an added layer of protection for your account.

Configuration Steps:

1. Go to Breached Password Protection in the Admin Console.
2. Enable breached password protection.
3. Select events to trigger checks (e.g., login, registration, password change).
4. Choose actions (e.g., notify user, prompt password change, record breach).
5. Enter admin email(s) for breach alerts.
6. Save changes.

This document provides detailed information on Breached Password Protection customization and configuration.

Bot Protection

Bot Protection prevents automated attacks by integrating CAPTCHA mechanisms and blocking suspicious login attempts.

Configuration Steps:

1. Navigate to Bot Protection in the Admin Console and enable it using the toggle button.
2. Select the captcha from the dropdown.
3. Enter the site key, secret key, and Risk threshold value.
4. Save the settings.

Account Enumeration Protection

Account Enumeration Protection prevents attackers from probing your user base through the public availability APIs. Account enumeration is a reconnaissance technique where an attacker submits an email address, phone number, or username and uses the API response to confirm whether an account exists — information that is later weaponized for credential stuffing, targeted phishing, or password-spray attacks.

• Toggle enabled (recommended): The public Email Availability, Phone Number Availability, and Username Availability APIs are blocked entirely. Requests to these endpoints are rejected regardless of whether Bot Protection challenges are configured. These three APIs are not selectable under Bot Protection Allowed On APIs.
• Toggle disabled: The three availability APIs remain reachable. They become selectable under Bot Protection Allowed On APIs (Email Availability, Phone Availability, Username Availability), so you can require a CAPTCHA challenge on each call instead of blocking it outright. Disable this toggle only if your sign-up or account-recovery flow depends on these endpoints, and pair it with CAPTCHA enforcement on the selected APIs to limit automated abuse.

This document provides detailed information on Bot Protection customization and configuration.

Domain Access Management

Domain Access Management helps prevent registrations from spam or disposable emails, allowing control over which users can access your app based on their email addresses.

Configuration Steps:

1. Navigate to Domain Access Management
2. Use the Allowlist and Blocklist options to add multiple email addresses or domains that you want to permit or restrict access to.
3. Add the email addresses, e.g., jon@otherdomain.com, or domains, e.g., somedomain.com, under Configuration to define the criteria for your whitelist or blacklist.

IP Access Management

Configure IP-based allowlists and blocklists to restrict inbound API traffic based on client IP addresses. Access rules can be managed and toggled independently for administrative endpoints (Manage API) and user authentication endpoints (Auth API).

Configuration Steps:

1. Navigate to Security → Attack Protection → IP Access Management in the Admin Console.
2. Select the tab corresponding to the scope you want to configure: Manage API or Auth API.
3. Turn on the toggle switch to Enable IP filtering for that scope.
4. Click New IP Rule and enter the desired IP configuration (single IPv4/IPv6, range, CIDR block, or comma-separated list).
5. Click Allow IP or Deny IP to save the rule with the selected access status.

See IP Access Management for supported formats and rule behavior.

Brute Force Lockout

Brute Force Lockout helps secure user accounts by limiting access after several failed login or password reset attempts via token or OTP. When a user repeatedly submits incorrect credentials in the Login API or invalid tokens/OTPs in the Reset Password by Token/OTP API and crosses the configured threshold, LoginRadius triggers a lockout response.

You can configure the lockout threshold in the Admin Console under the Brute Force Lockout Threshold setting.

How It Works

• Set a Threshold: Define the maximum number of failed login and password reset API attempts.

• Trigger a Lockout Action: The selected Lockout Type is applied once the threshold is reached.

• Track Lockout on User Profile: The following fields are updated in the user profile:

  • IsLoginLocked: Set to true

  • LoginLockedType: Stores the type of lockout applied

Lockout Types

The available lockout types and their behaviors are described in the following section:

Lockout Types

Lockout Type	Description	Requirements	API Response
Suspend	Temporarily restricts the user from logging in for a defined duration. You can configure the lockout duration using the Suspend Effective Period setting in the Admin Console.	Lockout Type "Suspend" must be configured in the Admin Console.Note: IsLoginLocked will be updated to true, but LoginLockedType remains unchanged.	{ "Description":"Your account has been locked, please try again after sometime.", "ErrorCode":1198, "Message":"Your account has been locked", "IsProviderError":false, "ProviderErrorResponse":null, "Data":{"LoginLockedTimeout":"2018-10-11T21:40:44.875Z"} }
Captcha	Prompts the user to complete a CAPTCHA challenge. For API logins, pass g-recaptcha-response (reCAPTCHA V2) or qq_captcha_ticket and qq_captcha_randstr (Tencent Captcha).	Google reCAPTCHA V2 or Tencent CAPTCHA must be configured in the Admin Console.	{ "Description": "Your account has been locked, please enter reCAPTCHA in order to login.", "ErrorCode": 1132, "Message": "Your account has been locked, please enter reCAPTCHA in order to login", "IsProviderError": false, "ProviderErrorResponse": null }
SecurityQuestion	Prompts the user to answer a configured security question. For API logins, pass the answer in the securityanswer field.	At least one security question must be configured in the Admin Console, and the user must have a saved answer.	{ "Description": "Your account has been locked, please enter the answer to the security question in order to login.", "ErrorCode": 1148, "Message": "Your account has been locked", "IsProviderError": false, "ProviderErrorResponse": null }
Block	Prevents login until unblocked by an administrator.Blocked users can be unblocked via Admin Console or by setting "isActive": true using the Account Update API.	Lockout Type "Block" must be selected in the Admin Console.	{ "Description": "Your account has been blocked by the system admin, please contact the admin for more information.", "ErrorCode": 991, "Message": "Your account is blocked", "IsProviderError": false, "ProviderErrorResponse": null }

Breached Password Protection

This feature checks if user passwords have been exposed in known external data breaches and prompts appropriate actions to enhance account security.

Configuration Steps:

1. Navigate to Breached Password Protection section of Console, and enable the feature using the top toggle.

2. Select triggers:

   • Login – Check during login and choose an action:

     • Record Breach
     • Ask for Password Change
     • Send Notification

   • Registration – Alert user if the password is compromised during sign-up.

   • Password Change – Validate new passwords before accepting them.

3. (Optional) Enable Admin Notifications for login or registration breach events.

4. Click Update to save changes.

IP Access Management

IP Access Management filters inbound API requests by client IP address. You define rules separately for the Manage API scope, which covers administrative endpoints, and the Auth API scope, which covers user authentication endpoints.

Supported formats

The rules editor accepts IPv4 and IPv6 addresses in the following formats.

Format	IPv4 example	IPv6 example	Matches
Single IP	192.168.1.100	2001:db8::1	One exact IP address.
IP range	192.168.1.1-192.168.1.50	2001:db8::1-2001:db8::ff	Every address in the inclusive range.
CIDR block	10.0.0.0/24	2001:db8::/32	Every address in the subnet. The prefix length is /0 to /32 for IPv4 and /0 to /128 for IPv6.
Comma-separated list	192.168.1.10, 192.168.1.20	2001:db8::1, 2001:db8::2	Each listed address. Use a list to add several single IPs in one step.

Rule behavior

Each request is evaluated against the rules of the scope that the endpoint belongs to. The following rules govern that evaluation.

• Scope independence: The Manage API and Auth API scopes operate independently. Enabling, updating, or disabling rules in one scope does not change the active state or rule list of the other.
• Allowlist mode: When a scope contains at least one Allow entry, every IP address that is not explicitly allowed is denied.
• Blocklist mode: When a scope contains only Deny entries, every IP address is accepted except those that match a denied entry.
• Conflict prevention: An IP address or range cannot appear in both the Allow and Deny lists. The editor validates entries in real time and rejects duplicates and overlapping ranges.
• Disable confirmation: Turning off IP filtering for a scope opens a confirmation dialog, because the scope then accepts requests from all IP addresses.

Related Resources

MFA GuideRisk-based/Adaptive AuthenticationPassword Management