Login - Allow only 3 attempts

Question

I am creating a new application..I created a login page successfully..Now I need to modify the login page ..Only 3 attempts only allowed for a user ..If the user wrongly enters the password more than 3 times(within 5 min) his account must be blocked..And error message must be shown as You cant access your page ..Please share your ideas...

Answer 1

use a MembershipProvider and in your web.config, in system.web you can configure number of attempts and timeouts. Set maxInvalidPasswordAttempts="3" and passwordAttemptWindow="5" for your requirements.

<membership defaultProvider="MyMembershipProvider">
  <providers>
    <clear/>
    <add name="MyMembershipProvider"
         type="MyMembershipProvider"
         autogenerateschema="true"
         connectionStringName="MyConnectionString"
         enablePasswordRetrieval="false"
         enablePasswordReset="true"
         requiresQuestionAndAnswer="false"
         requiresUniqueEmail="false"
         passwordFormat="Hashed"
         maxInvalidPasswordAttempts="3"
         minRequiredPasswordLength="8"
         minRequiredNonalphanumericCharacters="1"
         passwordAttemptWindow="5"
         passwordStrengthRegularExpression=""
         applicationName="/"  />
  </providers>
</membership>

This will require some configuration, but when configured properly (maybe even with a roleprovider) the default asp.net Login Controls can handle almost everything for you, even a PasswordRecovery and CreateUserWizard. The MembershipProvider will generate all required tables for user registration automatically.

The database can be a mdb file, ms sqlserver or mysql database.