Duplicate entries when behind a reverse proxy about django-axes HOT 6 CLOSED

This is related to issue #6 dealing with distributed attacks. Not sure what the best approach would be for resolving this behavior while still handling the distributed attacks.

from django-axes.

Any ideas? cc @aclark4life

from django-axes.

@camilonova I get all the emails anyway 😄

from django-axes.

Should we leave this open until a solution appears?

from django-axes.

@Eggplant77 Can you send a pull request?

from django-axes.

I think there is a problem with the changes added in Issue #6

That patch prevents distributed attacks this way: there is a failed attempts counter for every IP, and there is a failures counter for every user. To avoid locking out legitimate users every time a valid login is completed, it stores (ip, user, true) in the DB.

In [108]: [ "%s %s %s %s" % (at.attempt_time, at.ip_address, at.username, at.failures) for at in models.AccessAttempt.objects.all() ]
Out[108]:
[u'2014-05-23 16:06:03.964579 10.10.10.3 usuario 2',
u'2014-05-23 16:00:43.780034 None usuario 3', <--- there is no way I can now login from 192.168.0.50
u'2014-05-23 16:00:43.608362 192.168.0.104 None 3']

The problem is this: if I am a legitimate user connecting from an IP i've never used before I get locket out. In other words: after a lockout of my user in ANY ip, I can then only login from known IP addresses. That creates a DOS in many internet apps.

from django-axes.