Password Lock after Multiple Login Attempts for Django + simplejwt

Question

I'm building Django app and implemented login function with django restframework simplejwt.
Now trying to add function to lock out users after multiple wrong login attempts.

Many people suggest django-axes package, but it only works with Django's default authentication backend, not with simplejwt's views.

Any existing python packages help for this? Otherwise, how do you implement such a function with simplejwt?

Answer 1

I could image a vanilla solution by adding is_locked and login_counter fields for the user model and updating them as per your logic in the login views. For example, [login-failed -> counter += 1 -> (counter>3) then is_locked=true]. Then perhaps something like [changed password -> counter = 0 and is_locked = False]. This is nothing robust and syncing/simultaneous-requests could be problem but maybe a starting point. There are methods provided by django to lock the instance until the transaction is done such as select_for_update, so you can look at that as well.