What causes "Login has been temporarily blocked For User" in RocketChat/Rocket.Chat?

Wait for Block_Multiple_Failed_Logins_Time_To_Unblock_By_User_In_Minutes to elapse, then authenticate carefully

RocketChat/Rocket.Chat · error · Meteor.Error

error-login-blocked-for-user

error-login-blocked-for-user

Error message

Login has been temporarily blocked For User

What it means

validateLoginAttemptAsync -> isValidAttemptByUser rejects the login when Block_Multiple_Failed_Logins_Enabled and Block_Multiple_Failed_Logins_By_User are on and the target username has Block_Multiple_Failed_Logins_Attempts_Until_Block_by_User failed attempts (counted from ServerEvents) within Block_Multiple_Failed_Logins_Time_To_Unblock_By_User_In_Minutes. The username is read from login.methodArguments[0].user.username, so the block triggers even when attempts used wrong passwords for that name.

Source

Thrown at apps/meteor/server/lib/auth/startup.js:419

		Apps.self?.triggerEvent(AppEvents.IPostUserCreated, { user, performedBy: options.performedBy }).catch((e) => {
			Apps.self?.getRocketChatLogger().error({ msg: 'Error while executing post user created event', err: e });
		});
	}

	return _id;
};

const validateLoginAttemptAsync = async function (login) {
	login = await callbacks.run('beforeValidateLogin', login);

	if (!(await isValidLoginAttemptByIp(getClientAddress(login.connection)))) {
		throw new Meteor.Error('error-login-blocked-for-ip', 'Login has been temporarily blocked For IP', {
			function: 'Accounts.validateLoginAttempt',
		});
	}

	if (!(await isValidAttemptByUser(login))) {
		throw new Meteor.Error('error-login-blocked-for-user', 'Login has been temporarily blocked For User', {
			function: 'Accounts.validateLoginAttempt',
		});
	}

	if (login.allowed !== true) {
		return login.allowed;
	}

	if (login.user.type === 'visitor') {
		return true;
	}

	if (login.user.type === 'app') {
		throw new Meteor.Error('error-app-user-is-not-allowed-to-login', 'App user is not allowed to login', {
			function: 'Accounts.validateLoginAttempt',
		});
	}

View on GitHub (pinned to b2c16d5842)

Solutions

Wait for Block_Multiple_Failed_Logins_Time_To_Unblock_By_User_In_Minutes to elapse, then authenticate carefully
Temporarily raise the threshold or disable Block_Multiple_Failed_Logins_By_User to recover access for the affected account
Fix the failing client (reset password, update stored credentials) so it stops incrementing the failed counter
Consider keeping By_User blocking off if it lets attackers deny service to legitimate users

Defensive patterns

Strategy: try-catch

Try / catch

try {
  await loginWithPassword(user, password);
} catch (e) {
  if (e instanceof Meteor.Error && e.error === 'error-login-blocked-for-user') {
    // account temporarily locked: show wait time, stop retries, offer password reset flow
  }
  throw e;
}

Prevention

Rotate stale credentials in scripts/CI immediately after password changes so they stop feeding the counter
Set a moderate Block_Multiple_Failed_Logins_Attempts_Until_Block_by_User and short unblock window
Offer self-service password reset so users do not brute-force their own memory
Monitor for attackers deliberately locking usernames (denial of service)

When it happens

Trigger: Any login attempt as that username after the failed-attempt count reaches the threshold inside the window: password spraying against a known username, a user retrying after forgetting the password, or an automation with stale credentials hammering the account.

Common situations: Users typo passwords repeatedly and lock themselves out; credential-stuffing locks real usernames (an attacker can lock victims out without ever knowing the password); scripts with rotated credentials keep failing after a password change.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/9efb66a5bc80912c. Report an issue: GitHub.