# \#attack-protection **URL:** https://community.auth0.com/tag/attack-protection/1739.md [Latest](https://community.auth0.com/latest.md) · [Categories](https://community.auth0.com/categories.md) · [Tags](https://community.auth0.com/tags.md) --- ## [Make all failed password attempts count toward lockout, and override brute-force IP behavior](https://community.auth0.com/t/make-all-failed-password-attempts-count-toward-lockout-and-override-brute-force-ip-behavior/201114)
**Author:** [@dfleming](https://community.auth0.com/u/dfleming)\ **Replies:** 5\ **Last updated:** [July 6, 2026, 2:21pm UTC](https://community.auth0.com/t/make-all-failed-password-attempts-count-toward-lockout-and-override-brute-force-ip-behavior/201114 "2026-07-06T14:21:35Z")
Hi all — hoping to confirm a couple of things about brute-force protection on a database connection (Username-Password-Authentication), with the password policy set to Excellent. Do submissions that fail the password … --- ## [Potential bypass of too\_many\_attempts on /dbconnection/password\_change via encoded characters](https://community.auth0.com/t/potential-bypass-of-too-many-attempts-on-dbconnection-password-change-via-encoded-characters/193013)
**Author:** [@gedeon.u](https://community.auth0.com/u/gedeon.u)\ **Replies:** 6\ **Last updated:** [October 21, 2025, 6:46pm UTC](https://community.auth0.com/t/potential-bypass-of-too-many-attempts-on-dbconnection-password-change-via-encoded-characters/193013 "2025-10-21T18:46:36Z")
Hi Auth0 Team, I want to report a potential security issue with the /dbconnection/password\_change endpoint in Auth0 database connections. Issue: It appears that using certain URL-encoded control characters, e.g., "%01… --- ## [Protecting Auth0 Credentials and Encryption Keys Stored in Android SharedPreferences](https://community.auth0.com/t/protecting-auth0-credentials-and-encryption-keys-stored-in-android-sharedpreferences/190440)
**Author:** [@chandru\_thillai\_edhc](https://community.auth0.com/u/chandru_thillai_edhc)\ **Replies:** 0\ **Last updated:** [August 11, 2025, 1:40pm UTC](https://community.auth0.com/t/protecting-auth0-credentials-and-encryption-keys-stored-in-android-sharedpreferences/190440 "2025-08-11T13:40:12Z")
(topic deleted by author) --- ## [OTP requests limit](https://community.auth0.com/t/otp-requests-limit/187823)
**Author:** [@jayem](https://community.auth0.com/u/jayem)\ **Replies:** 1\ **Last updated:** [June 16, 2025, 12:03pm UTC](https://community.auth0.com/t/otp-requests-limit/187823 "2025-06-16T12:03:06Z")
We are using OTP codes for our users to login to our apps. I am currently working on test automation. We have white listed the office IP in our test tenant but I seem to be running into some type of throttling/blocking.… --- ## [Suspicious IP Throttling for Access Token Request](https://community.auth0.com/t/suspicious-ip-throttling-for-access-token-request/134997)
**Author:** [@akanksha.nichrelay](https://community.auth0.com/u/akanksha.nichrelay)\ **Replies:** 1\ **Last updated:** [April 30, 2025, 3:08pm UTC](https://community.auth0.com/t/suspicious-ip-throttling-for-access-token-request/134997 "2025-04-30T15:08:39Z")
Do the Suspicious IP throttling settings also apply to the brute force or suspicious call to /oauth/token for access token request for Client credential grants? If not, how can we throttle suspicious attempts for acces… --- ## [Auth Challenge in monitoring mode, what log events indicate it would have been triggered?](https://community.auth0.com/t/auth-challenge-in-monitoring-mode-what-log-events-indicate-it-would-have-been-triggered/184425)
**Author:** [@robert.white](https://community.auth0.com/u/robert.white)\ **Replies:** 4\ **Last updated:** [March 25, 2025, 7:26pm UTC](https://community.auth0.com/t/auth-challenge-in-monitoring-mode-what-log-events-indicate-it-would-have-been-triggered/184425 "2025-03-25T19:26:37Z")
We currently have Auth Challenge in monitoring mode and would like to filter logs to identify how many times it would have been triggered prior to enabling it. What log event should I filter by? --- ## [Getting Authentication error "URL can be used only once' from the Brute-force blocked email](https://community.auth0.com/t/getting-authentication-error-url-can-be-used-only-once-from-the-brute-force-blocked-email/183093)
**Author:** [@naresh.seth](https://community.auth0.com/u/naresh.seth)\ **Replies:** 1\ **Last updated:** [March 31, 2025, 7:44pm UTC](https://community.auth0.com/t/getting-authentication-error-url-can-be-used-only-once-from-the-brute-force-blocked-email/183093 "2025-03-31T19:44:50Z")
There is Authentication Error “URL can be used only once”, while clicking the Blocked email received. This link works file, if i use gmail, but gives error, when i use outlook. Although, despite getting error “Authentica… --- ## [Consistent Unauthorized Access Attempts on Auth0 /authorize Endpoint - Possible Bot Activity](https://community.auth0.com/t/consistent-unauthorized-access-attempts-on-auth0-authorize-endpoint-possible-bot-activity/182088)
**Author:** [@brijesh2](https://community.auth0.com/u/brijesh2)\ **Replies:** 1\ **Last updated:** [February 14, 2025, 11:31pm UTC](https://community.auth0.com/t/consistent-unauthorized-access-attempts-on-auth0-authorize-endpoint-possible-bot-activity/182088 "2025-02-14T23:31:48Z")
We’re seeing unauthorized requests consistently targeting our Auth0’s /authorize endpoint over the past few days. These requests originate from different IPs and attempt various unauthorized redirect URLs. Some requests … --- ## [How to Ensure JWT Access Tokens Are Not Stolen in an Angular SPA + NestJS Setup?](https://community.auth0.com/t/how-to-ensure-jwt-access-tokens-are-not-stolen-in-an-angular-spa-nestjs-setup/169872)
**Author:** [@franchelli.leo](https://community.auth0.com/u/franchelli.leo)\ **Replies:** 2\ **Last updated:** [January 23, 2025, 11:53am UTC](https://community.auth0.com/t/how-to-ensure-jwt-access-tokens-are-not-stolen-in-an-angular-spa-nestjs-setup/169872 "2025-01-23T11:53:03Z")
Hi everyone, I’ve been following the blog posts and quickstart guides for building an Angular SPA with a NestJS backend, and everything is working great so far. However, I have a few concerns regarding security and woul… --- ## [Limit OTP attempts in Form / Too Many Beats](https://community.auth0.com/t/limit-otp-attempts-in-form-too-many-beats/146233)
**Author:** [@jshewfelt](https://community.auth0.com/u/jshewfelt)\ **Replies:** 1\ **Last updated:** [January 17, 2025, 9:45pm UTC](https://community.auth0.com/t/limit-otp-attempts-in-form-too-many-beats/146233 "2025-01-17T21:45:05Z")
Is there a way to introduce a hard limit on the number of password attempts in the new Forms OTP flow? We would like a solution where after 10 incorrect OTP attempts the user is forced to send a new OTP to their email. I… --- ## [Custom threshold "rate" for suspicious IP throttling](https://community.auth0.com/t/custom-threshold-rate-for-suspicious-ip-throttling/167819)
**Author:** [@eric.pelkey\_ex](https://community.auth0.com/u/eric.pelkey_ex)\ **Replies:** 1\ **Last updated:** [January 7, 2025, 10:53pm UTC](https://community.auth0.com/t/custom-threshold-rate-for-suspicious-ip-throttling/167819 "2025-01-07T22:53:28Z")
What is the unit of the “rate” in custom suspicious IP throttling? Is “200” 30 minutes, “400” 60 minutes, etc? --- ## [Not displayed 'Account Blocked' Message Immediately After Threshold is Reached](https://community.auth0.com/t/not-displayed-account-blocked-message-immediately-after-threshold-is-reached/162306)
**Author:** [@nirajan.kunwor](https://community.auth0.com/u/nirajan.kunwor)\ **Replies:** 1\ **Last updated:** [December 13, 2024, 6:40pm UTC](https://community.auth0.com/t/not-displayed-account-blocked-message-immediately-after-threshold-is-reached/162306 "2024-12-13T18:40:24Z")
I have configured the Brute Force Protection feature with a login threshold of 5 attempts. However, I’ve noticed an issue with the user experience. When a user reaches the login attempt limit, they receive an email to u… --- ## [IP blocked for too many consecutive logins](https://community.auth0.com/t/ip-blocked-for-too-many-consecutive-logins/150151)
**Author:** [@gilberto.taccari](https://community.auth0.com/u/gilberto.taccari)\ **Replies:** 1\ **Last updated:** [November 30, 2024, 6:00pm UTC](https://community.auth0.com/t/ip-blocked-for-too-many-consecutive-logins/150151 "2024-11-30T18:00:43Z")
Hello :wave: I use Auth0’s Universal Login for a Single Page Application, and sometimes multiple users sign in from the same IP address because they are on the same network. Recently, I encountered the following error: … --- ## [Suspicious login attempts detected on Auth0](https://community.auth0.com/t/suspicious-login-attempts-detected-on-auth0/134357)
**Author:** [@segiryamya](https://community.auth0.com/u/segiryamya)\ **Replies:** 3\ **Last updated:** [May 20, 2024, 4:45pm UTC](https://community.auth0.com/t/suspicious-login-attempts-detected-on-auth0/134357 "2024-05-20T16:45:03Z")
I’m receiving frequent notifications from Auth0 about “suspicious logins.” Details: Auth0 detected an excessive number of failed login attempts from one or more IP addresses. The IPs associated with the suspicious act… --- ## [Blocked user not getting email](https://community.auth0.com/t/blocked-user-not-getting-email/127206)
**Author:** [@abhishek5](https://community.auth0.com/u/abhishek5)\ **Replies:** 1\ **Last updated:** [February 13, 2024, 12:30pm UTC](https://community.auth0.com/t/blocked-user-not-getting-email/127206 "2024-02-13T12:30:33Z")
Hi , I have turned on brute for protection and have turned on the send notification toggle . Even after doing so , the user is not getting an email . I have checked in spam too . I checked the monitoring logs as well ,… --- ## [Unblock an IP address via the Auth0 UI, instead of the API](https://community.auth0.com/t/unblock-an-ip-address-via-the-auth0-ui-instead-of-the-api/122910)
**Author:** [@pavel-tpt](https://community.auth0.com/u/pavel-tpt)\ **Replies:** 1\ **Last updated:** [December 12, 2023, 10:07pm UTC](https://community.auth0.com/t/unblock-an-ip-address-via-the-auth0-ui-instead-of-the-api/122910 "2023-12-12T22:07:11Z")
Howdy, We had an IP address blocked by the Brute-force detection feature. We’d like to unblock this address. It seems from looking around that my only options are adding it to the AllowList (which we don’t want to do,… --- ## [Cloudflare Turnstile Integration](https://community.auth0.com/t/cloudflare-turnstile-integration/122370)
**Author:** [@niezle-ziolko](https://community.auth0.com/u/niezle-ziolko)\ **Replies:** 2\ **Last updated:** [December 11, 2023, 6:16pm UTC](https://community.auth0.com/t/cloudflare-turnstile-integration/122370 "2023-12-11T18:16:24Z")
Hello, I would like to know if there is perhaps any information on the addition of Cloudflare Turnstile integration to CAPTCHA Providers? Is there any anticipation of adding this option to the panel in the near future? … --- ## [Customizing the unlock page of Brute-Force Protection](https://community.auth0.com/t/customizing-the-unlock-page-of-brute-force-protection/120158)
**Author:** [@d-kimuson](https://community.auth0.com/u/d-kimuson)\ **Replies:** 3\ **Last updated:** [November 13, 2023, 7:37pm UTC](https://community.auth0.com/t/customizing-the-unlock-page-of-brute-force-protection/120158 "2023-11-13T19:37:23Z")
I am trying Brute-Force Protection. I was able to customize the html of email that is sent when user account is blocked according to this documentation. However, I have not found a way to customize the page after moved… --- ## [How can i trust the token?](https://community.auth0.com/t/how-can-i-trust-the-token/116444)
**Author:** [@Toudahl](https://community.auth0.com/u/Toudahl)\ **Replies:** 4\ **Last updated:** [October 6, 2023, 7:42am UTC](https://community.auth0.com/t/how-can-i-trust-the-token/116444 "2023-10-06T07:42:13Z")
Hello, I hope you have a bit of patience for some, perhaps, silly questions. Despite being a software professional several years, i have never been part of setting up auth. This has always been a functioning part of an… --- ## [Regular Web Application - clientSecret dangers](https://community.auth0.com/t/regular-web-application-clientsecret-dangers/116408)
**Author:** [@toomuchtimeondocs](https://community.auth0.com/u/toomuchtimeondocs)\ **Replies:** 1\ **Last updated:** [September 19, 2023, 10:33pm UTC](https://community.auth0.com/t/regular-web-application-clientsecret-dangers/116408 "2023-09-19T22:33:20Z")
So, in M2M applications, it’s very easy to select scopes for the API and control, what can be done using clientId & clientSecret. But what are the risks of leaked clientId & clientSecret in Regular Web Application? Ca… --- ## [Clickjacking for Classic Universal Login](https://community.auth0.com/t/clickjacking-for-classic-universal-login/113698)
**Author:** [@matthewyoung245](https://community.auth0.com/u/matthewyoung245)\ **Replies:** 3\ **Last updated:** [August 16, 2023, 11:26pm UTC](https://community.auth0.com/t/clickjacking-for-classic-universal-login/113698 "2023-08-16T23:26:37Z")
I am using the classic universal login and wasn’t sure if I needed to turn migrations on to prevent clickjacking. I think I’m getting confused if it needs to be enabled or not because of this link. Also, where woul… --- ## [Unblock link in Account blocked email not working when used with organizations](https://community.auth0.com/t/unblock-link-in-account-blocked-email-not-working-when-used-with-organizations/109645)
**Author:** [@junya.takaichi](https://community.auth0.com/u/junya.takaichi)\ **Replies:** 2\ **Last updated:** [August 3, 2023, 6:11am UTC](https://community.auth0.com/t/unblock-link-in-account-blocked-email-not-working-when-used-with-organizations/109645 "2023-08-03T06:11:57Z")
I’m testing the brute force protection feature and noticed that the unblock link in Account blocked email does not work showing the error message connection is disabled (client\_id: xxxxx - connection: xxxxx). I guess thi… --- ## [Does "Block compromised credentials for new accounts" also block password changes?](https://community.auth0.com/t/does-block-compromised-credentials-for-new-accounts-also-block-password-changes/108502)
**Author:** [@m-c](https://community.auth0.com/u/m-c)\ **Replies:** 3\ **Last updated:** [June 6, 2023, 11:33pm UTC](https://community.auth0.com/t/does-block-compromised-credentials-for-new-accounts-also-block-password-changes/108502 "2023-06-06T23:33:43Z")
Currently we have the attack protection “Breached Password Detection” enabled with the two following toggles: Block compromised credentials for new accounts (Automatically block compromised credentials when users are c… --- ## [Unblocking Email](https://community.auth0.com/t/unblocking-email/107888)
**Author:** [@avinash.rathod](https://community.auth0.com/u/avinash.rathod)\ **Replies:** 5\ **Last updated:** [May 30, 2023, 3:00pm UTC](https://community.auth0.com/t/unblocking-email/107888 "2023-05-30T15:00:36Z")
Hi, In the event that a user receives an unblock email but fails to click on the unblock link within the specified time frame, what is the process to request another unblocking email? Is there a way for the user to init… --- ## [I don't understand how the throttling rate works](https://community.auth0.com/t/i-dont-understand-how-the-throttling-rate-works/107439)
**Author:** [@maronn](https://community.auth0.com/u/maronn)\ **Replies:** 3\ **Last updated:** [May 24, 2023, 3:12am UTC](https://community.auth0.com/t/i-dont-understand-how-the-throttling-rate-works/107439 "2023-05-24T03:12:14Z")
I don’t understand the mechanism for releasing time-based restrictions in Suspicious IP throttling. According to the documentation, it states that if the Throttling rate is set to 100, a previously blocked IP will be abl… --- ## [Unblock user automatically](https://community.auth0.com/t/unblock-user-automatically/106070)
**Author:** [@jeanbaptiste.marie](https://community.auth0.com/u/jeanbaptiste.marie)\ **Replies:** 2\ **Last updated:** [May 5, 2023, 9:46am UTC](https://community.auth0.com/t/unblock-user-automatically/106070 "2023-05-05T09:46:04Z")
Hello, I am looking for the best way to unblock automatically a blocked user account. Indeed a user might be blocked after several login attempts that failed. There is an API that can be used to unblock the user program… --- ## [Clarification on brute force protection velocity](https://community.auth0.com/t/clarification-on-brute-force-protection-velocity/105656)
**Author:** [@jo.humphrey](https://community.auth0.com/u/jo.humphrey)\ **Replies:** 1\ **Last updated:** [May 2, 2023, 7:51pm UTC](https://community.auth0.com/t/clarification-on-brute-force-protection-velocity/105656 "2023-05-02T19:51:59Z")
Hi there, In the docs on Attack protection, there is a summary about brute force protection that I think is a bit unclear: Brute-force Protection: \*\*Velocity\*\* of login attempts from an IP for a particular account. Det… --- ## [Can the 30 day account block due to brute force protection be extended?](https://community.auth0.com/t/can-the-30-day-account-block-due-to-brute-force-protection-be-extended/105652)
**Author:** [@jo.humphrey](https://community.auth0.com/u/jo.humphrey)\ **Replies:** 1\ **Last updated:** [April 28, 2023, 6:44am UTC](https://community.auth0.com/t/can-the-30-day-account-block-due-to-brute-force-protection-be-extended/105652 "2023-04-28T06:44:00Z")
Hi there, I found in the docs that a blocked user can get automatically unblocked after 30 days since their last unsuccessful login. Is there any way to turn this feature off, or extend the 30 day window? Ideally we wou… --- ## [Token Expiration for PKCE flow(used in auth0-js-spa SDK)](https://community.auth0.com/t/token-expiration-for-pkce-flow-used-in-auth0-js-spa-sdk/97501)
**Author:** [@mattoo.sagar](https://community.auth0.com/u/mattoo.sagar)\ **Replies:** 1\ **Last updated:** [March 28, 2023, 1:17pm UTC](https://community.auth0.com/t/token-expiration-for-pkce-flow-used-in-auth0-js-spa-sdk/97501 "2023-03-28T13:17:01Z")
We are using the PKCE flow(used in auth0-js-spa SDK) in our front-end application. The token for the protected api is fetched via the token endpoint. Refering to link Update Access Token Lifetime (auth0.com), if we redu… --- ## [Auth0 Terraform Bot Attack Configuration](https://community.auth0.com/t/auth0-terraform-bot-attack-configuration/100493)
**Author:** [@sadhasivam](https://community.auth0.com/u/sadhasivam)\ **Replies:** 1\ **Last updated:** [February 15, 2023, 7:12am UTC](https://community.auth0.com/t/auth0-terraform-bot-attack-configuration/100493 "2023-02-15T07:12:30Z")
Hi Folks i am trying to configure auth0 bot attack configuration via Terraform. any idea how to do so https://registry.terraform.io/providers/auth0/auth0/latest/docs/resources/attack\_protection I see suspicious\_ip\_t… [Next page](https://community.auth0.com/tag/attack-protection/1739.md?match_all_tags=true&page=1&tags%5B%5D=attack-protection)