Created: 2011-07-06 23:09
Updated: 2017-05-02 02:26


Attempt Component

A simple component to protect sensitive actions from brute force attacks.



Returns the number of failed attempts for a certain action.

limit($action, $limit = 5)

Returns false if the number of failed attempts is bigger than the passed limit.

fail($action, $duration = '+10 minutes')

Creates a failed attempt that counts towards the limit for the passed duration


Deletes all failed attempts for a certain action


Deletes all expired failed attempts from the database. This should be run via CakeShell (ideally as a CRON job) every now and then.


CREATE TABLE `attempts` (
  `id` char(36) NOT NULL DEFAULT '',
  `ip` varchar(64) DEFAULT NULL,
  `action` varchar(32) DEFAULT NULL,
  `created` datetime DEFAULT NULL,
  `expires` datetime DEFAULT NULL,
  PRIMARY KEY (`id`),
  KEY `ip` (`ip`,`action`),
  KEY `expires` (`expires`)

Example Implementation

class ExampleController extends Controller {
	var $components = array(
	var $loginAttemptLimit = 10;
	var $loginAttemptDuration = '+1 hour';
	public function login() {
		// Form submitted?
		if ( $formSubmitted = true ) {
			// All required fields entered?
			if ( $validFormData = true ) {
				// Limit to 10 failed attempts
				if ( $this->Attempt->limit('login', $this->loginAttemptLimit) ) {
					// Validate user credentials
					if ( $validCredentials = true ) {
						// Log user in
					} else {
						// Invalid credentials, count as failed attempt for an hour
						$this->Attempt->fail('login', $this->loginAttemptDuration);
						$this->Session->setFlash('Unknown user or wrong password');
				} else {
					// User exceeded attempt limit
					// Ideally show a CAPTCHA (ensuring this is not a robot 
					// without blocking out and frustrating users),
					// otherwise show error message
					$this->Session->setFlash('Too many failed attempts!');
			} else {
				// Invalid form data but keep it ambiguous
				$this->Session->setFlash('Unknown user or wrong password');
Cookies help us deliver our services. By using our services, you agree to our use of cookies Learn more