750
However, the software makes no attempt to restrict excessive authentication attempts.
Example 3:
This code attempts to limit the number of login attempts by causing the process to sleep before
completing the authentication.
Example Language: PHP (Bad)
$username = $_POST['username'];
$password = $_POST['password'];
sleep(2000);
$isAuthenticated = authenticateUser($username, $password);
However, there is no limit on parallel connections, so this does not increase the amount of time an
attacker needs to complete an attack.
Example 4:
In the following C/C++ example the validateUser method opens a socket connection, reads
a username and password from the socket and attempts to authenticate the username and
password.
Example Language: C (Bad)
int validateUser(char *host, int port)
{
int socket = openSocketConnection(host, port);
if (socket < 0) {
printf("Unable to open socket connection");
return(FAIL);
}
int isValidUser = 0;
char username[USERNAME_SIZE];
char password[PASSWORD_SIZE];
while (isValidUser == 0) {
if (getNextMessage(socket, username, USERNAME_SIZE) > 0) {
if (getNextMessage(socket, password, PASSWORD_SIZE) > 0) {
isValidUser = AuthenticateUser(username, password);
}
}
}
return(SUCCESS);
}
The validateUser method will continuously check for a valid username and password without any
restriction on the number of authentication attempts made. The method should limit the number of
authentication attempts made to prevent brute force attacks as in the following example code.
Example Language: C (Good)
int validateUser(char *host, int port)
{
...
int count = 0;
while ((isValidUser == 0) && (count < MAX_ATTEMPTS)) {
if (getNextMessage(socket, username, USERNAME_SIZE) > 0) {
if (getNextMessage(socket, password, PASSWORD_SIZE) > 0) {
isValidUser = AuthenticateUser(username, password);
}
}
count++;
}
if (isValidUser) {
return(SUCCESS);
}
CWE Version 4.14
CWE-307: Improper Restriction of Excessive Authentication Attempts
CWE-307: Improper Restriction of Excessive Authentication Attempts