Locking an account which has had too many sequential, failed login attempts within a short time can help resist brute force attacks. This rule raises an issue on authentication code so that such controls can be verified.


== Noncompliant Code Example

----
env.put(Context.SECURITY_PRINCIPAL, principal);
env.put(Context.SECURITY_CREDENTIALS, password);

DirContext ctx = new InitialDirContext(env);  // Noncompliant
----


== See

* https://www.owasp.org/index.php/Top_10-2017_A2-Broken_Authentication[OWASP Top 10 2017 Category A2] - Broken Authentication
* http://cwe.mitre.org/data/definitions/307[MITRE, CWE-307] - Improper Restriction of Excessive Authentication Attempts
* https://www.sans.org/top25-software-errors/#cat3[SANS Top 25] - Porous Defenses

