Brute-force protection

Credential counts wrong passwords. After too many, it warns the player and then locks them out for a while. The settings are in scenario.authentication.bruteforce of providers/Credential/settings.yml:

scenario:
  authentication:
    bruteforce:
      maxAttempts: 5
      lockout:
        enabled: true
        duration: "5m"
      warning:
        enabled: true
        thresholdPercentage: 50

• After maxAttempts wrong passwords within lockout.duration, the player is locked out for lockout.duration. maxAttempts: 0 turns the protection off.
• With lockout.enabled: false, wrong passwords are still counted and warned about, but nobody is locked out.
• The warning starts once thresholdPercentage of the attempts are used: with 5 attempts and 50, from the third wrong password, which leaves two.

lockout.duration is also how long a wrong password is remembered, so with the defaults five wrong passwords within five minutes lock a player out.

The protection is part of the sentinel feature: features.sentinel.enabled: false in Credential's entry of providers/providers.yml turns it off as well.

See Settings for every setting.