Search code examples
djangodjango-rest-frameworkdjango-authentication

Django axes resets cool off the moment another failed login occurs

Currently, Django axes will reset the cool-off timer to the latest time a failed login attempt happened.

For example: After 3 failed logins, axes will lock out the user account at 10 am for 15 minutes. If I attempt a 4th time at 10:10 am, it will extend the lockout to 10:25 am.

Is there any way to modify axes so that it will not reset the cool off time on any subsequent wrong login?

Solution

  • This was fixed in the 5.32 release of django-axes yesterday:

    https://github.com/jazzband/django-axes/pull/865

    To get the behavior you're looking for, set AXES_RESET_COOL_OFF_ON_FAILURE_DURING_LOCKOUT to False in your django settings file.