spec 1 linked patterns checked
OWASP Authentication Cheat Sheet login throttling
Documents login throttling, account lockout thresholds, observation windows, lockout duration, exponential lockout, denial-of-service risk, CAPTCHA cautions, logging and monitoring, and password-manager guidance.
Read with a purpose
What this source can teach
Use this source to check a technical or accessibility requirement against its exact wording and scope.
- Start with the original. Open the source and find the guidance or example relevant to your task.
- Trace the connection. Use the claim notes below to see how this site applies the source to specific patterns.
- Check the setting. Compare the source's platform, people, and constraints with your own decision.
Pattern Decisions This Source Supports
| Pattern | Supported decision | Required contract | Claim note |
|---|---|---|---|
| Login | Choose login when the user has submitted credentials or an authenticator and the UI must show the result, next retry, lockout, or session-created state. | Submitting credentials enters one clear verifying state and prevents duplicate submissions until the login result returns. | OWASP supports login throttling, account lockout policy factors, exponential lockout, CAPTCHA cautions, and monitoring. |
Evidence Role
This source is treated as spec evidence. Its value comes from the specific claims and setting described above.
Publisher: OWASP Cheat Sheet Series. Last checked: .