codeigniter4 / shield

Authentication and Authorization for CodeIgniter 4

Home Page:https://shield.codeigniter.com

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Bug: `AccessTokens` authenticator records all accesses to "Auth Token Login Attempts" table

kenjis opened this issue · comments

commented

Now that I'm thinking through this more, I don't know that access tokens or JWT really need to be tracked every page view anyway. Tracking login attempts is more for catching bad actors attempting to break into accounts. With PAT and JWT, I don't believe you typically see these same types of attacks, so rapidly expanding a database to very large sizes doesn't seem beneficial.
#195 (comment)

if (! $result->isOK()) {
// Always record a login attempt, whether success or not.
$this->loginModel->recordLoginAttempt(
self::ID_TYPE_ACCESS_TOKEN,
$credentials['token'] ?? '',
false,
$ipAddress,
$userAgent
);
return $result;
}