ghassanandClaude Opus 4.7
3122420a3d
- Drop /login throttle from 10/min to 5/min per IP. - After every failed login, count user.login.failed audit entries for the same email in the last 10 minutes. If >=5, fire a one-shot (cache-deduped) BruteForceLoginAlert notification to every super admin via database + mail channels. - Alert carries the email, originating IP, failure count and window so the admin can decide whether to force a reset. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
52 lines
1.7 KiB
PHP
52 lines
1.7 KiB
PHP
<?php
|
|
|
|
namespace App\Notifications;
|
|
|
|
use Illuminate\Bus\Queueable;
|
|
use Illuminate\Notifications\Messages\MailMessage;
|
|
use Illuminate\Notifications\Notification;
|
|
|
|
/**
|
|
* Fires to every super admin when the same email or IP has produced several
|
|
* failed login attempts in a short window. Lets ops decide whether to lock
|
|
* the account, change the password, or just raise the global throttle.
|
|
*/
|
|
class BruteForceLoginAlert extends Notification
|
|
{
|
|
use Queueable;
|
|
|
|
public function __construct(
|
|
public readonly string $email,
|
|
public readonly string $ip,
|
|
public readonly int $failures,
|
|
public readonly int $windowMinutes,
|
|
) {}
|
|
|
|
public function via(object $notifiable): array
|
|
{
|
|
return ['database', 'mail'];
|
|
}
|
|
|
|
public function toArray(object $notifiable): array
|
|
{
|
|
return [
|
|
'kind' => 'brute_force_login_alert',
|
|
'email' => $this->email,
|
|
'ip' => $this->ip,
|
|
'failures' => $this->failures,
|
|
'window_minutes' => $this->windowMinutes,
|
|
];
|
|
}
|
|
|
|
public function toMail(object $notifiable): MailMessage
|
|
{
|
|
return (new MailMessage)
|
|
->subject('TAKEONE — suspicious login attempts')
|
|
->greeting('Possible brute-force login attempt')
|
|
->line("The address {$this->email} has had {$this->failures} failed login attempts in the last {$this->windowMinutes} minutes.")
|
|
->line("Most recent attempt came from {$this->ip}.")
|
|
->line('Review the audit log and consider forcing a password reset if this account looks real.')
|
|
->action('Open Admin', url('/admin/audit-logs'));
|
|
}
|
|
}
|