User Lockout Doesn't work if the user doesn't have an email id MVC 5

Question

I am trying to lockout a user after n number of unsuccessful attempts and this only works if the user has an email id and i am using username instead of an email id to login into my application.In this scenario is there a way i can lockout the user without an email id too ?

Answer 1

You could try the keeping a failure counter in a session variable. You will need to add session state to web.config to use this code though.

In your controller

    public int getFailedAttempts()
    {
        int? failedAttempts = Session["FailedAttempts"] as int?;

        if (failedAttempts != null)
        {
            return (int)failedAttempts;
        }
        else {
            return 0;
        }
    }

    public void handleFailedAttempt()
    {
        var failedAttempts = getFailedAttempts();

        Session["FailedAttempts"] = failedAttempts + 1;
    }

In web.config

    <system.web>
      ...
      <sessionState mode="InProc" timeout="30" />
    </system.web>