I have an application where the user is asked to retype his password to confirm certain actions. This verification is done in the server, using the login endpoint. The problem is that as all these calls are made from the server, it triggers the brute force anomaly detection if there are more than 100 failed login in 24hours - it is the same IP.
We received the email warning us our server IP was blocked. We clicked the unblock link on the first email, but soon after another one was sent because the IP was blocked again. We whitelisted the IP another time and some time later it was blocked again. Then we just turned the brute force protection off.
But what I wanted was to white list that IP and keep brute force protection on.
Is there any way to check which IPs are whitelisted for brute force protection?
My application is of the “native” type here on Auth0 and I can’t change the token endpoint authentication method so I could send my user’s IP instead of using mine - which would improve my brute force protection. Or is there any other way that my server can send a “login” request using my user’s IP?