{"action":"created","issue":{"url":"https://api.github.com/repos/OrchardCMS/Orchard/issues/6607","repository_url":"https://api.github.com/repos/OrchardCMS/Orchard","labels_url":"https://api.github.com/repos/OrchardCMS/Orchard/issues/6607/labels{/name}","comments_url":"https://api.github.com/repos/OrchardCMS/Orchard/issues/6607/comments","events_url":"https://api.github.com/repos/OrchardCMS/Orchard/issues/6607/events","html_url":"https://github.com/OrchardCMS/Orchard/issues/6607","id":142051948,"number":6607,"title":"The login functionality is vulnerable to Brute Force attack","user":{"login":"Garpo001","id":4099702,"avatar_url":"https://avatars.githubusercontent.com/u/4099702?v=3","gravatar_id":"","url":"https://api.github.com/users/Garpo001","html_url":"https://github.com/Garpo001","followers_url":"https://api.github.com/users/Garpo001/followers","following_url":"https://api.github.com/users/Garpo001/following{/other_user}","gists_url":"https://api.github.com/users/Garpo001/gists{/gist_id}","starred_url":"https://api.github.com/users/Garpo001/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Garpo001/subscriptions","organizations_url":"https://api.github.com/users/Garpo001/orgs","repos_url":"https://api.github.com/users/Garpo001/repos","events_url":"https://api.github.com/users/Garpo001/events{/privacy}","received_events_url":"https://api.github.com/users/Garpo001/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/OrchardCMS/Orchard/milestones/29","html_url":"https://github.com/OrchardCMS/Orchard/milestones/dev","labels_url":"https://api.github.com/repos/OrchardCMS/Orchard/milestones/29/labels","id":1138648,"number":29,"title":"dev","description":"Issues assigned to this milestone have been approved to be developed in the next major version release of Orchard.","creator":{"login":"sebastienros","id":1165805,"avatar_url":"https://avatars.githubusercontent.com/u/1165805?v=3","gravatar_id":"","url":"https://api.github.com/users/sebastienros","html_url":"https://github.com/sebastienros","followers_url":"https://api.github.com/users/sebastienros/followers","following_url":"https://api.github.com/users/sebastienros/following{/other_user}","gists_url":"https://api.github.com/users/sebastienros/gists{/gist_id}","starred_url":"https://api.github.com/users/sebastienros/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sebastienros/subscriptions","organizations_url":"https://api.github.com/users/sebastienros/orgs","repos_url":"https://api.github.com/users/sebastienros/repos","events_url":"https://api.github.com/users/sebastienros/events{/privacy}","received_events_url":"https://api.github.com/users/sebastienros/received_events","type":"User","site_admin":false},"open_issues":137,"closed_issues":4,"state":"open","created_at":"2015-05-28T19:26:41Z","updated_at":"2016-03-24T19:22:17Z","due_on":null,"closed_at":null},"comments":5,"created_at":"2016-03-19T11:08:35Z","updated_at":"2016-03-24T19:22:49Z","closed_at":null,"body":"The login page ~/users/account/logon doesn't have any protection against password-guessing attacks (brute force attacks). An attacker can use multiple payloads to get access to the user account without knowing the password. It is recommended to implement some type of account lockout after a defined number of incorrect password attempts."},"comment":{"url":"https://api.github.com/repos/OrchardCMS/Orchard/issues/comments/200982233","html_url":"https://github.com/OrchardCMS/Orchard/issues/6607#issuecomment-200982233","issue_url":"https://api.github.com/repos/OrchardCMS/Orchard/issues/6607","id":200982233,"user":{"login":"dcinzona","id":52411,"avatar_url":"https://avatars.githubusercontent.com/u/52411?v=3","gravatar_id":"","url":"https://api.github.com/users/dcinzona","html_url":"https://github.com/dcinzona","followers_url":"https://api.github.com/users/dcinzona/followers","following_url":"https://api.github.com/users/dcinzona/following{/other_user}","gists_url":"https://api.github.com/users/dcinzona/gists{/gist_id}","starred_url":"https://api.github.com/users/dcinzona/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dcinzona/subscriptions","organizations_url":"https://api.github.com/users/dcinzona/orgs","repos_url":"https://api.github.com/users/dcinzona/repos","events_url":"https://api.github.com/users/dcinzona/events{/privacy}","received_events_url":"https://api.github.com/users/dcinzona/received_events","type":"User","site_admin":false},"created_at":"2016-03-24T19:22:49Z","updated_at":"2016-03-24T19:22:49Z","body":"How about a cool down timer instead of captcha? Cool down per user. In memory could be sufficient or cache?"}}