We have added protection against brute force login attacks which aim to gain access to user accounts by repeatedly trying to guess a username and corresponding password. A user account will be locked out for a set period of time after a number of failed login attempts to prevent automated attacks. All failed attempts of the same user on each server are counted individually, no matter from where the request is coming, e.g., from Desktop UI, web UI, or via a REST call. The count of failed attempts is automatically reset once the lock period is reached, or a login has been successful before the number of

maximumFailedAttempts

has been reached. The corresponding maximum allowed attempts count and lock period are configurable within the following settings in the

plugin_customization.ini.