Redeem Invitation - Maximum Attempts? (Brute-force prevention)

(0) Share

Report

Posted on by rokenrolla

Hello Everyone,

Thanks for reading my post.

Following are the steps we're following:

For Portal Registration/Login (using Local Login), we're inviting our customers using 'Create Invitation'.
Users are receiving the invitation email as well as an SMS with an invitation code.
Users are clicking on the link and they land on the Redeem Invitation page.
Users enter the received invitation code and proceed to the "Register" page where they enter their email address and password.

We would like to implement logic to limit the maximum attempts on the page where the user is entering the received invitation code. In other words, we would like to prevent brute-force attacks so that the attacker would not be able to get to the "Registration" page if they unsuccessfully enter the invitation code more than 3 times.

Categories:

General topics

Invitation Page.png

I have the same question (0)

All responses (4)

Answers (0)

Christ0f 147 on at

Like (0)

Report

One should use the site setting "Authentication/LoginThrottling/MaxInvaildAttemptsFromIPAddress" via Portal Management.

Schermafbeelding ...

Was this reply helpful? Yes No
Fubar 8,354 Super User 2025 Season 2 on at

Like (0)

Report

Also, there is a field "Maximum Redemptions" on the Invitation table that allows you to set the maximum number of uses of the Invitation code (e.g. set it to 1, so that the Invitation is no longer valid after it has been redeemed). The field is not on the Invitation form by default, but you can add it on or set it with a workflow etc when the Invitation record is created. And you can also set Expiry Date on your invitations, so they are not left open for an extended period of time.

Was this reply helpful? Yes No
rokenrolla 6 on at

Like (0)

Report

Hi Christ0f,

Thank you so much for the quick response. I already have this Site Setting configured, and it's a great feature to have.

However, we would also like to limit the number of attempts when the user is trying to redeem the invitation.

Was this reply helpful? Yes No
rokenrolla 6 on at

Like (0)

Report

Hi Fubar,

Thank you so much for the quick response. I already have "Maximum Redemptions" set to 1, but we would also like to limit the number of attempts when the user is trying to redeem the invitation. I guess I could additionally implement some logic in a workflow and invoke it after the invitation is redeemed.

However, I still hope to find the right solution to limit the maximum attempts when the user is trying to register using the invitation code.

Was this reply helpful? Yes No