Class InMemoryLoginAttemptPolicy

java.lang.Object

com.svenruppert.jsentinel.bruteforce.InMemoryLoginAttemptPolicy

All Implemented Interfaces:

LoginAttemptPolicy

public final class InMemoryLoginAttemptPolicy
extends Object
implements LoginAttemptPolicy

In-memory LoginAttemptPolicy suitable for single-node demos and small deployments.

Counts failures per (username, clientAddress) pair plus an additional username-only counter so an attacker cannot cycle clients to evade the combined counter. Username and clientAddress are normalised (lower-cased + trimmed) before use as map keys.

After LoginAttemptConfiguration.failureThreshold() failures inside LoginAttemptConfiguration.window() the key is locked for LoginAttemptConfiguration.initialLockout(). Repeated breaches double the lockout up to LoginAttemptConfiguration.maxLockout() (progressive backoff). A successful recordSuccess resets the combined counter; the username-only counter is reset on the next successful login by the same user even from a different client.

Audit

The policy emits audit events through the resolved JSentinelAuditService:

• LoginFailed on every recordFailure
• BruteForceLimitReached the first time a key crosses the failure threshold

Audit-sink failures are swallowed — they must never break the security flow that emitted them.

Constructor Summary

Constructors

Constructor	Description
InMemoryLoginAttemptPolicy()	Defaults — suitable for single-node demos.
InMemoryLoginAttemptPolicy(LoginAttemptConfiguration config, Clock clock, JSentinelAuditService auditService)

Method Summary

Modifier and Type	Method	Description
LoginAttemptDecision	beforeAttempt(LoginAttemptContext context)	Decides whether the attempt described by context may proceed.
void	recordFailure(LoginAttemptContext context)	Records a failed attempt.
void	recordSuccess(LoginAttemptContext context)	Records a successful attempt.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

InMemoryLoginAttemptPolicy

public InMemoryLoginAttemptPolicy()

Defaults — suitable for single-node demos.

InMemoryLoginAttemptPolicy

public InMemoryLoginAttemptPolicy(LoginAttemptConfiguration config,
 Clock clock,
 JSentinelAuditService auditService)

Parameters:

config - throttling thresholds

clock - time source — fixed clocks make testing deterministic

auditService - audit sink, or null to resolve from JSentinelServiceResolver on each event

Method Details

beforeAttempt

public LoginAttemptDecision beforeAttempt(LoginAttemptContext context)

Description copied from interface: LoginAttemptPolicy

Decides whether the attempt described by context may proceed. Implementations must not mutate the failure counter here — that is the responsibility of LoginAttemptPolicy.recordSuccess(LoginAttemptContext) / LoginAttemptPolicy.recordFailure(LoginAttemptContext) after the actual check.

Specified by:

beforeAttempt in interface LoginAttemptPolicy

Parameters:

context - attempt context

Returns:

decision; never null

recordSuccess

public void recordSuccess(LoginAttemptContext context)

Description copied from interface: LoginAttemptPolicy

Records a successful attempt. Implementations typically reset the per-key failure counter so a successful login lifts a partial lockout immediately.

Specified by:

recordSuccess in interface LoginAttemptPolicy

Parameters:

context - attempt context

recordFailure

public void recordFailure(LoginAttemptContext context)

Description copied from interface: LoginAttemptPolicy

Records a failed attempt. Implementations typically increment a per-key counter and may escalate the throttling decision.

Specified by:

recordFailure in interface LoginAttemptPolicy

Parameters:

context - attempt context