PHP code example of ali1 / cakephp-bruteforce

    
        
<?php
require_once('vendor/autoload.php');

/* Start to develop here. Best regards https://php-download.com/ */

    

ali1 / cakephp-bruteforce example snippets

// In project_root/Application.php:
        $this->addPlugin('Bruteforce');

// in AppController.php or any controller

    public function initialize(): void
    {
        parent::initialize();
        $this->loadComponent('Bruteforce.Bruteforce');
    }

    public function login(): void
    {
        $config = new \Ali1\BruteForceShield\Configuration(); // see possible options below

        /**
         * @param string $name a unique string to store the data under (different $name for different uses of Brute
     *                          force protection within the same application.
         * @param array $data an array of data, can use $this->request->getData()
         * @param \Ali1\BruteForceShield\Configuration|null $config options
         * @param string $cache Cache to use (default: 'default'). Make sure to use one with a duration longer than your time window otherwise you will not be protected.
         * @return void
         */
        $this->Bruteforce->validate(
            'login',
            ['username' => $this->request->getData('username'), 'password' => $this->request->getData('password')],
            $config,
            'default'          
        );
        
        // the user will never get here if fails Brute Force Protection
        // a TooManyAttemptsException will be thrown
        // usual login code here
    }

// UsersController.php
    public $components = ['Bruteforce.Bruteforce'];
    
    ...
    
    public function login()
    {
        // prior to actually verifying data
        $bruteConfig = new \Ali1\BruteForceShield\Configuration();
        $bruteConfig->setTotalAttemptsLimit(5);
        $bruteConfig->setStricterLimitOnKey('username', 3); // setting a limit of 5 above, then a different limit here would mean the user has 3 chances to get the password right, but then an additional 2 chances if they try a different username
        $bruteConfig->addUnencryptedKey('username'); // adding this would mean you could see which usernames are being attacked in your log files

        $this->Bruteforce->validate(
            'login', // unique name for this BruteForce action
            ['username' => $this->request->getData('username'), 'password' => $this->request->getData('password')],
            $bruteConfig
        );
        // rest of the login code to authorize the attempt
    }

    /**
     * @param string|null $hashedid
     *
     * @return void
     */
    public function publicAuthUrl(string $hashedid): void
    {
        try {
            $bruteConfig = new Configuration();
            $bruteConfig->addUnencryptedKey('hashedid');
            $this->Bruteforce->validate(
                'publicHash',
                ['hashedid' => $hashedid],
                $bruteConfig
            );
        } catch (\Bruteforce\Exception\TooManyAttemptsException $e) {
            $this->Flash->error('Too many requests attempted. Please try again in a few minutes');
            return $this->redirect('/');
        }
        
        // then check if URL is actually valid

// AppController.php::initialize()

        $this->loadComponent('Bruteforce.Bruteforce'); // Keep above any authentication components if running on initialize (default)
        $this->Bruteforce->validate(
            'login', // unique name for this BruteForce action
            ['username' => $this->request->getData('username'), 'password' => $this->request->getData('password')] // user entered data
        );
        // this will not affect any other action except ones containing POSTed usernames and passwords (empty challenges never get counted or blocked)