Does password reset clear user blocks?

Get Help
,
1

I’m working on a custom solution to identify and clear blocked user accounts using the Auth0 SDK and would like to confirm some behavior I am seeing. It looks like when a user’s password is reset, that seems to also clear any user blocks that have been created by a “limit_wc” condition.

That’s what empirical evidence shows, but I wonder if anyone here can confirm that it’s correct.

3

In Auth0, when brute force protection is enabled:

  • It tracks failed login attempts using this “limit_wc” condition
  • When users exceed the maximum number of failed attempts, their account gets blocked
  • By default, the shield is triggered after 10 failed login attempts
  • The default block duration is 600 seconds (10 minutes)

Password reset do appears to clear block created by (“limit_wc”) condition in Auth0.

However, if blocks created due to Suspicious IP or admin applied blocks would remain in place even after a password reset.

4

Hi @kmaloney,

Yes, performing a password reset will remove the block that was enforced from brute force protection.

Our When Do the Attempts for Brute Force Protection Reset knowledge article mentions this.

Thanks,
Rueben