spec 1 linked patterns checked
OWASP Authentication Cheat Sheet login throttling
Documents login throttling, account lockout thresholds, observation windows, lockout duration, exponential lockout, denial-of-service risk, CAPTCHA cautions, logging and monitoring, and password-manager guidance.
Read with a purpose
What this source can teach
Use this source to check a technical or accessibility requirement against its exact wording and scope.
- Start with the original. Open the source and find the guidance or example relevant to your task.
- Trace the connection. Use the claim notes below to see how this site applies the source to specific patterns.
- Check the setting. Compare the source's platform, people, and constraints with your own decision.
Pattern Decisions This Source Supports
| Pattern | Supported decision | Required contract | Claim note |
|---|---|---|---|
| Login | Choose login when the user has submitted credentials or an authenticator and the UI must show the result, next retry, lockout, or session-created state. | Submitting credentials enters one clear verifying state and prevents duplicate submissions until the login result returns. | OWASP supports login throttling, account lockout policy factors, exponential lockout, CAPTCHA cautions, and monitoring. |
Comparisons supported by this source
- Login vs sign in vs password input vs session timeout warning
OWASP supports login throttling, account lockout factors, exponential lockout, CAPTCHA caution, and logging or monitoring around authentication.
Evidence Role
This source is treated as spec evidence. Its value comes from the specific claims and setting described above.
Publisher: OWASP Cheat Sheet Series. Last checked: .