Hi team - I have a couple of questions about the security of passwordless code flows via email in Ory Network: • Is there somewhere where we can configure the code lifespan? It looks like this is configurable in Kratos • Are there any protections against excessive code attempts / account locking. I'm really looking for something similar to Auth0's brute force prevention as documented here: https://auth0.com/docs/authenticate/passwordless/best-practices#prevent-brute-force-attacks-

Hello @fierce-lion-12678 1. Yes you can configure the lifespan - right now this is only possible using the Ory CLI e.g.

ory get identity-config --project $PROJECT_ID --format json-pretty > config.json

this is the section you want to update:

"code": {
        "config": {
          "lifespan": "15m0s",
          "missing_credential_fallback_enabled": true
        },

2. Ory has similar brute-force protections built-in for the code method. Only the latest code is valid and you can set the lifespan yourself. Repeated attempts are blocked on the API level as part of general rate limiting against brute-force attempts, you can read more about this here.

Thanks for this @magnificent-energy-493 🙏