Limit Invalid Password Reset Attempts
The password_reset.request.max_attempt is used to control the maximum number of unsuccessful attempts that a user can reset or change their password before being locked out for a specified period of time.
The password_reset.request.max_attempt system property dictates the maximum number of unsuccessful password reset attempts that can be taken before the user is locked out of password reset process. The lockout period is determined by the value in password_reset.request.max_attempt_window.
Ensure that the property password_reset.request.max_attempt is set to 3 or less.
More information
| Attribute | Description |
|---|---|
| Configuration name | password_reset.request.max_attempt |
| Configuration type | System Properties \(/sys\_properties\_list.do\) |
| Data type | Integer |
| Recommended value | An integer less than or equal to 3 |
| Default value | <none> |
| Fallback value | 3 |
| Category | Configure Password Reset properties |
| Security risk | - Severity score: 7.5 - CVSS rating: High - Security risk details: If the value is too high, then it could be possible to perform brute force attack against password reset process. |
| Functional impact | None |
| Dependencies and prerequisites | None |
Parent Topic:Authentication