How to Secure Login APIs: Prevent Brute‑Force, MITM, and Other Attacks

01 Preface

When learning web backend development, many start with a simple login feature, but often overlook security considerations.

02 Security Risks

Brute‑Force Attacks

Publicly exposed sites are vulnerable to password‑guessing attacks. Example pseudocode:

# Password dictionary
password_dict = []
# Login URL
login_url = ''
def attack(username):
    for password in password_dict:
        data = {'username': username, 'password': password}
        content = requests.post(login_url, data).content.decode('utf-8')
        if 'login success' in content:
            print('got it! password is : %s' % password)

Mitigation: introduce captcha after several failed attempts.

fail_count = get_from_redis(fail_username)
if fail_count >= 3:
    if captcha is None:
        return error('需要验证码')
    check_captcha(captcha)
success = do_login(username, password)
if not success:
    set_redis(fail_username, fail_count + 1)

Note: concurrency should be handled with locking.

Login Rate Limiting

Lock an account after many failed attempts and release after a cooldown period.

fail_count = get_from_redis(fail_username)
locked = get_from_redis(lock_username)
if locked:
    return error('拒绝登录')
if fail_count >= 3:
    if captcha is None:
        return error('需要验证码')
    check_captcha(captcha)
success = do_login(username, password)
if not success:
    set_redis(fail_username, fail_count + 1)
if fail_count + 1 >= 10:
    set_redis(lock_username, true, 300s)

Be aware that locking by username can be abused to deny service for many users.

IP‑Based Restrictions

Block an IP after a threshold of failed logins.

ip = request['IP']
fail_count = get_from_redis(fail_ip)
if fail_count > 10:
    return error('拒绝登录')
# other logic …
success = do_login(username, password)
if not success:
    set_redis(fail_ip, true, 300s)

IP blocking may affect legitimate users behind shared IPs or VPNs.

Mobile Verification

Combine password attempts with SMS or app‑based verification for stronger protection.

if fail_count > 3:
    require_captcha()
if fail_count > 10:
    require_sms_code()
# validate sms code …

Man‑in‑the‑Middle (MITM) Attacks

Attackers can intercept login requests to steal credentials. Using HTTPS encrypts traffic, providing confidentiality, integrity, and authentication.

Additional Defensive Measures

Record operation logs with IP and device information.

Send alerts for abnormal login activities.

Enforce strong password policies.

Prevent username enumeration.