Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Good GMT morning, feel free to RTFM but where should I look to implement a maximum number of login attempts?
Would that be  builtin within kratos, or a hook that looks up my own datastore, or entirely upstream in my application?

Looks like this was asked and partially answered before
<https://ory-community.slack.com/archives/C010F7Z4XM1/p1655532490496469>

This thread is very much about protecting against sending too may emails.
Before that, I have a requirement to limit the number of login attempts, and lock the account when reached. Seems like a basic requirement, but doesn't seem to be built in so maybe not?

Hi Franck, Ory Kratos currently does not support rate limiting login attempts. Contributions are definitely welcome, though.