Login Throttling

ShipStream protects password logins on the Admin UI and Client UI against password guessing. Badge, Social Login and API logins work as before.

How It Works

ShipStream keeps track of failed password logins. When too many come from the same network, or are made against the same username, in a short time, ShipStream turns further attempts away for a while without checking the password. A refused attempt shows Too many failed login attempts. Try again later.

Accounts are never locked. Someone entering wrong passwords for a username on purpose can slow that username down, but its owner can still sign in from a network where they have signed in recently.

A successful password login that follows many failed attempts may mean someone has guessed the password. ShipStream emails the User who signed in with the time, where the sign-in and the failed attempts came from, and what to do if it was not them. They know best whether it was them; if it was not, they should change their password with Forgot your password? on the sign-in page and tell their administrator.

Login Error Messages

So that the login form does not help someone guess accounts, every failed password login shows Invalid Username or Password. That includes a correct password for:

• a User whose account is inactive or has no role,
• a Client User whose Merchant is inactive or archived,
• a User who must sign in with Google or Microsoft because of Password Login or Force SSO for Domains.

If a User reports that a password they know is correct is refused, check these settings on their User edit page before resetting the password.