[GH-ISSUE #3045] Brute force not behave correctly #1086

New issue

Open

opened 2026-03-07 20:59:12 +03:00 by kerem · 0 comments

kerem commented

2026-03-07 20:59:12 +03:00

Owner

Originally created by @boonhanchng on GitHub (Nov 5, 2024).
Original GitHub issue: https://github.com/dbeaver/cloudbeaver/issues/3045

Originally assigned to: @yagudin10 on GitHub.

Describe the bug
I had configured my cloudbeaver with the env variable in docker

         - name: CLOUDBEAVER_BRUTE_FORCE_PROTECTION_ENABLED
           value: "true"
        - name: CLOUDBEAVER_MAX_FAILED_LOGINS
          value: "3"
        - name: CLOUDBEAVER_MINIMUM_LOGIN_TIMEOUT
          value: "1"
        - name: CLOUDBEAVER_BLOCK_PERIOD
          value: "30"

With CLOUDBEAVER_MINIMUM_LOGIN_TIMEOUT = 1, according to the code in repo, this should be last login attempt within 1second.
Once I logout, try to login again i will hit the exception

org.jkiss.dbeaver.DBException: Too frequent authentication requests
	at io.cloudbeaver.service.security.bruteforce.BruteForceUtils.checkLoginInterval(BruteForceUtils.java:65)
	at io.cloudbeaver.service.security.bruteforce.BruteForceUtils.checkBruteforce(BruteForceUtils.java:40)
	at io.cloudbeaver.service.security.CBEmbeddedSecurityController.createNewAuthAttempt(CBEmbeddedSecurityController.java:1620)
	at io.cloudbeaver.service.security.CBEmbeddedSecurityController.authenticate(CBEmbeddedSecurityController.java:1541)
	at io.cloudbeaver.service.auth.impl.WebServiceAuthImpl.authLogin(WebServiceAuthImpl.java:92)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:569)

To Reproduce
Steps to reproduce the behavior:

Login to CloudBeaver
Logout
Try to login again
See error

Screenshots
If applicable, add screenshots to help explain your problem.

Originally created by @boonhanchng on GitHub (Nov 5, 2024). Original GitHub issue: https://github.com/dbeaver/cloudbeaver/issues/3045 Originally assigned to: @yagudin10 on GitHub. **Describe the bug** I had configured my cloudbeaver with the env variable in docker ``` - name: CLOUDBEAVER_BRUTE_FORCE_PROTECTION_ENABLED value: "true" - name: CLOUDBEAVER_MAX_FAILED_LOGINS value: "3" - name: CLOUDBEAVER_MINIMUM_LOGIN_TIMEOUT value: "1" - name: CLOUDBEAVER_BLOCK_PERIOD value: "30" ``` With CLOUDBEAVER_MINIMUM_LOGIN_TIMEOUT = 1, according to the code in repo, this should be last login attempt within 1second. Once I logout, try to login again i will hit the exception ``` org.jkiss.dbeaver.DBException: Too frequent authentication requests at io.cloudbeaver.service.security.bruteforce.BruteForceUtils.checkLoginInterval(BruteForceUtils.java:65) at io.cloudbeaver.service.security.bruteforce.BruteForceUtils.checkBruteforce(BruteForceUtils.java:40) at io.cloudbeaver.service.security.CBEmbeddedSecurityController.createNewAuthAttempt(CBEmbeddedSecurityController.java:1620) at io.cloudbeaver.service.security.CBEmbeddedSecurityController.authenticate(CBEmbeddedSecurityController.java:1541) at io.cloudbeaver.service.auth.impl.WebServiceAuthImpl.authLogin(WebServiceAuthImpl.java:92) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:569) ``` **To Reproduce** Steps to reproduce the behavior: 1. Login to CloudBeaver 2. Logout 3. Try to login again 4. See error **Screenshots** If applicable, add screenshots to help explain your problem. ![image](https://github.com/user-attachments/assets/da38380f-ee83-4b67-91d9-f6b4874417ef)