From b325b4fbeb087928b42855e834f8ef7c8c3f987f Mon Sep 17 00:00:00 2001 From: Thomas Landauer Date: Sun, 14 Aug 2022 23:05:41 +0200 Subject: [PATCH] Deleting duplicate "default" Since you cannot configure the ``5 * max_attempts`` part, this is an unnecessary duplication. --- security.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security.rst b/security.rst index 2cf429e6dd4..78f1a3bb52a 100644 --- a/security.rst +++ b/security.rst @@ -1470,7 +1470,7 @@ You must enable this using the ``login_throttling`` setting: The ``login_throttling.interval`` option was introduced in Symfony 5.3. -By default, login attempts are limited on ``max_attempts`` (default: 5) +Login attempts are limited on ``max_attempts`` (default: 5) failed requests for ``IP address + username`` and ``5 * max_attempts`` failed requests for ``IP address``. The second limit protects against an attacker using multiple usernames from bypassing the first limit, without