Forum Discussion
Cirrusf5 asm login pages / brute force detection header value
Hello,
I am trying to configure brute-force prevention and login pages. I have a header value that is set when the login fails on the specified login URL: "login-failed: true".
When the login succeeds there is no header like "login-failed: false" or "login-successful: true"
The problem is that the signon page is used for many different apps and this is the only thing that is in common for them all when the login fails.
Seems the "String that should not appear" is only scanning for body text so detecting failed logins is not working.
Are the only ways to make this work to tell the application guys to add "login-failed: false" or "login-succesful: true" header?
Chris_GrantEmployee
The application would need to have a header or string that signified a successful login for you to be able to use a header. We support the use of a header to signify success, but not to signify failure. We tend to assume failure until shown success. You can always open a support case and make a Request For Enhancement (RFE). We can send that to PD and request this feature, but can't guarantee when it might be implemented (or even if).