{
  "id": "07",
  "content": [
    {
      "type": "heading",
      "text": "Brute-Force Defense & Throttling"
    },
    {
      "type": "text",
      "html": "<pre><code class='language-php'>$max=5;$win=900;$k='login:'.$ip;\n$attempts=$store-&gt;incr($k);\n$store-&gt;expire($k,$win);\nif($attempts&gt;$max){ http_response_code(429); exit('Too many attempts'); }\n</code></pre>"
    },
    {
      "type": "text",
      "html": "<pre><code># Apache modules (configure in server conf): mod_evasive, mod_security\n# Idea: block IP after N rapid requests to /login\n</code></pre>"
    }
  ],
  "quiz": {
    "questions": [
      {
        "id": "q1",
        "type": "single",
        "text": "A reasonable sample limit is:",
        "options": [
          {
            "id": "a",
            "text": "5 attempts per 15 minutes"
          },
          {
            "id": "b",
            "text": "Unlimited"
          },
          {
            "id": "c",
            "text": "1 per week"
          }
        ],
        "correct": [
          "a"
        ]
      },
      {
        "id": "q2",
        "type": "single",
        "text": "Apache module for blocking abusive clients:",
        "options": [
          {
            "id": "a",
            "text": "mod_evasive"
          },
          {
            "id": "b",
            "text": "mod_autoindex"
          },
          {
            "id": "c",
            "text": "mod_alias"
          }
        ],
        "correct": [
          "a"
        ]
      }
    ]
  }
}