登录暴力破解防护（渐进式锁定/速率阈值）最佳实践

背景与价值登录接口易遭受暴力破解。基于账号与设备特征实施渐进式锁定与速率控制，可有效阻断攻击并保持可用性。统一规范维度：账号ID与设备指纹双维度计数与锁定。渐进策略：失败次数越多，锁定时间窗口越长，上限封禁。白名单例外：受控IP或设备在低风险场景下放宽阈值。核心实现锁定器type Key = string type Clock = () => number class Lock { clock: Clock fails = new Map<Key, number>() until = new Map<Key, number>() constructor(clock: Clock = () => Date.now()) { this.clock = clock } reset(k: Key) { this.fails.set(k, 0); this.until.delete(k) } fail(k: Key) { const n = (this.fails.get(k) || 0) + 1 this.fails.set(k, n) const baseMs = 1000 const dur = Math.min(60_000, baseMs * Math.pow(2, Math.floor(n / 3))) this.until.set(k, this.clock() + dur) } locked(k: Key): boolean { const u = this.until.get(k) || 0; return this.clock() < u } count(k: Key): number { return this.fails.get(k) || 0 } } 速率限制与维度组合type Attempt = { account: string; device: string; success: boolean } class Gate { accountLock = new Lock() deviceLock = new Lock() allowIp = new Set<string>(['203.0.113.10']) try(attempt: Attempt, ip: string): boolean { const ak = 'a:' + attempt.account const dk = 'd:' + attempt.device if (this.allowIp.has(ip)) return true if (this.accountLock.locked(ak) || this.deviceLock.locked(dk)) return false if (!attempt.success) { this.accountLock.fail(ak); this.deviceLock.fail(dk) } else { this.accountLock.reset(ak); this.deviceLock.reset(dk) } return true } } 落地建议双维度锁定与速率限制结合，异常设备与账号同时触发冷却窗口。渐进式加长锁定时间，避免无限制尝试；成功登录重置计数。在受控IP环境下适度放宽阈值，但保留审计与限速。验证清单失败次数是否触发渐进式锁定并随次数增长而延长。正常用户在成功登录后是否立即解除锁定与计数。