ethercreative/yii2-login-attempts-behavior

⚠️ This repo is no longer being maintained.

Yii2 Login Attempts Behavior

Store login failures, and disable after multiple failures.

Installation

The preferred way to install this extension is through composer.

Either run

composer require ethercreative/yii2-login-attempts-behavior

or add

"ethercreative/yii2-login-attempts-behavior": "*"

to the require section of your composer.json file.

Usage

Run the following migration

php yii migrate --migrationPath="vendor/ethercreative/yii2-login-attempts-behavior/src/migrations"  --interactive=0

Add the behavior to your login model.

public function behaviors()
{
    $behaviors = parent::behaviors();

    $behaviors[] = [
        'class' => '\ethercreative\loginattempts\LoginAttemptBehavior',

        // Amount of attempts in the given time period
        'attempts' => 3,

        // the duration, for a regular failure to be stored for
        // resets on new failure
        'duration' => 300,

        // the unit to use for the duration
        'durationUnit' = 'second',

        // the duration, to disable login after exceeding `attemps`
        'disableDuration' => 900,

        // the unit to use for the disable duration
        'disableDurationUnit' => 'second',

        // the attribute used as the key in the database
        // and add errors to
        'usernameAttribute' => 'email',

        // the attribute to check for errors
        'passwordAttribute' => 'password',

        // the validation message to return to `usernameAttribute`
        'message' => 'Login disabled',
    ];

    return $behaviors;
}

Todo

• Add cache storage
• Add better DB support
• Add option for IP (other?) instead of key
• Add failure delay option
• More customisable

yii2-login-attempts-behavior's Issues

Reset _attemps after reach amounts of attemps

attempt->amount only increments and does not reset, and always returns an error after the first failure

error time format

mysql: 5.7
php: 7.2
os: windows7

SQLSTATE[22007]: Invalid datetime format: 1292 Incorrect datetime value: 'Mon, 25 Dec 2017 13:43:26 +0000' for column 'reset_at' at row 1
The SQL being executed was: INSERT INTO `login_attempt` (`key`, `amount`, `reset_at`, `created_at`, `updated_at`) VALUES ('103736cbc61de1f43e6ecfb3168a7fcdc1a25212', 1, 'Mon, 25 Dec 2017 13:43:26 +0000', NOW(), NOW())
Error Info: Array
(
    [0] => 22007
    [1] => 1292
    [2] => Incorrect datetime value: 'Mon, 25 Dec 2017 13:43:26 +0000' for column 'reset_at' at row 1
)

fix

 public function beforeValidate()
    {
        if ($this->_attempt = LoginAttempt::find()->where(['key' => $this->key])->andWhere(['>', 'reset_at', date('Y-m-d H:i:s')])->one()) {
            if ($this->_attempt->amount >= $this->attempts) {
                $this->owner->addError($this->usernameAttribute, $this->message);
            }
        }
    }

 public function afterValidate()
    {
        if ($this->owner->hasErrors($this->passwordAttribute)) {
            if (!$this->_attempt) {
                $this->_attempt = new LoginAttempt;
                $this->_attempt->key = $this->key;
            }
            $this->_attempt->amount += 1;
            $duration = $this->_attempt->amount >= $this->attempts ? $this->disableDuration : $this->duration;
            $this->_attempt->reset_at = date('Y-m-d H:i:s', strtotime('+' . $duration . ' seconds'));
            $this->_attempt->save();
        }
    }

PHP 5.4 compability

LoginAttemptBehavior.php:86
private function intervalExpression( int $length, $unit = 'second')
Type hinting was added in PHP 7, so only word 'int' stop you from PHP 5 support. And i didn't found described requirements for PHP 7. Thanks.