0Pricing
Spring Security 6 & JWT Authentication · Lesson

Account Lockout and Brute-Force Protection

Learn to defend login endpoints against password guessing by tracking failed attempts and temporarily locking accounts in Spring Security.

Account Lockout and Brute-Force Protection is a free Spring Security 6 & JWT Authentication lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Spring Security 6 & JWT Authentication learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

The Brute-Force Threat

Attackers automate thousands of login attempts to guess passwords. Without limits, even rate limiting may not stop a slow, distributed guessing campaign against a single account.

Lockout as Defense

Account lockout blocks login for an account after too many failed attempts within a window. This makes online guessing impractical.

Listening for Failures

Spring Security publishes events on authentication outcomes. Listen for AuthenticationFailureBadCredentialsEvent to count failures.

@EventListener
public void onFailure(AuthenticationFailureBadCredentialsEvent e) {
    String user = (String) e.getAuthentication().getPrincipal();
    attempts.recordFailure(user);
}

Tracking Attempt Counts

Keep a counter per username (or per username+IP). A simple cache with a time-to-live resets the count automatically after the window passes.

void recordFailure(String user) {
    int count = cache.getOrDefault(user, 0) + 1;
    cache.put(user, count, Duration.ofMinutes(15));
}

Resetting on Success

A successful login should clear the counter, so legitimate users who mistyped a few times are not punished later.

@EventListener
public void onSuccess(AuthenticationSuccessEvent e) {
    attempts.reset(e.getAuthentication().getName());
}

Enforcing the Lock

Implement a UserDetailsService (or check during login) that throws LockedException when the threshold is exceeded.

if (attempts.isBlocked(username)) {
    throw new LockedException('Account temporarily locked');
}

Marking the Account Non-Locked

The UserDetails contract has isAccountNonLocked(). Return false to make Spring reject the login automatically.

@Override
public boolean isAccountNonLocked() {
    return !attempts.isBlocked(username);
}

Temporary vs Permanent Locks

Prefer temporary locks that auto-expire (for example 15 minutes). Permanent locks frustrate users and create a denial-of-service vector where attackers lock victims out on purpose.

Avoid User Enumeration

Return the same generic error for wrong password and locked account when possible, so attackers cannot tell which usernames exist or are locked.

Adding Exponential Backoff

Instead of a hard lock, increase the delay after each failure. The first retry waits a second, the next two, then four, slowing attackers without fully blocking users.

long delayMs = (long) Math.pow(2, count) * 1000;

Persisting State

In a multi-instance deployment, store attempt counts in a shared store like Redis so a lock applies across all nodes, not just the one that saw the failures.

Quick Check

Test your understanding of brute-force protection.

Recap

You learned to protect logins from brute force:

  • Count failures via Spring authentication events
  • Lock the account through isAccountNonLocked() or a thrown LockedException
  • Reset counters on success and prefer temporary locks
  • Use backoff, avoid enumeration, and share state across instances

These measures make password guessing impractical without hurting real users.

Frequently asked questions

Is the “Account Lockout and Brute-Force Protection” lesson free?

Yes — the full text of “Account Lockout and Brute-Force Protection” is free to read here on the web, and the Spring Security 6 & JWT Authentication course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Spring Security 6 & JWT Authentication course, upgrade to CoddyKit PRO.

What will I learn in “Account Lockout and Brute-Force Protection”?

Learn to defend login endpoints against password guessing by tracking failed attempts and temporarily locking accounts in Spring Security. You practise Spring Security 6 & JWT Authentication with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Spring Security 6 & JWT Authentication?

No prior experience is required. Spring Security 6 & JWT Authentication on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Account Lockout and Brute-Force Protection” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Spring Security 6 & JWT Authentication lesson?

Yes. Every Spring Security 6 & JWT Authentication lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Implementing Multi-Factor Authentication
  2. Rate Limiting API Access
  3. Custom Authentication Event Handling
  4. Account Lockout and Brute-Force Protection
← Back to Spring Security 6 & JWT Authentication