{"record":{"id":"4eae468dca9d5ba1","repo":"RocketChat/Rocket.Chat","slug":"error-login-blocked-for-ip","errorCode":"error-login-blocked-for-ip","errorMessage":"Login has been temporarily blocked For IP","messagePattern":"Login has been temporarily blocked For IP","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/auth/startup.js","lineNumber":413,"sourceCode":"\t\t\t}\n\t\t}\n\t}\n\n\tif (!options.skipAppsEngineEvent) {\n\t\t// `post` triggered events don't need to wait for the promise to resolve\n\t\tApps.self?.triggerEvent(AppEvents.IPostUserCreated, { user, performedBy: options.performedBy }).catch((e) => {\n\t\t\tApps.self?.getRocketChatLogger().error({ msg: 'Error while executing post user created event', err: e });\n\t\t});\n\t}\n\n\treturn _id;\n};\n\nconst validateLoginAttemptAsync = async function (login) {\n\tlogin = await callbacks.run('beforeValidateLogin', login);\n\n\tif (!(await isValidLoginAttemptByIp(getClientAddress(login.connection)))) {\n\t\tthrow new Meteor.Error('error-login-blocked-for-ip', 'Login has been temporarily blocked For IP', {\n\t\t\tfunction: 'Accounts.validateLoginAttempt',\n\t\t});\n\t}\n\n\tif (!(await isValidAttemptByUser(login))) {\n\t\tthrow new Meteor.Error('error-login-blocked-for-user', 'Login has been temporarily blocked For User', {\n\t\t\tfunction: 'Accounts.validateLoginAttempt',\n\t\t});\n\t}\n\n\tif (login.allowed !== true) {\n\t\treturn login.allowed;\n\t}\n\n\tif (login.user.type === 'visitor') {\n\t\treturn true;\n\t}\n","sourceCodeStart":395,"sourceCodeEnd":431,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/auth/startup.js#L395-L431","documentation":"validateLoginAttemptAsync -> isValidLoginAttemptByIp rejects the login when brute-force protection by IP is active: Block_Multiple_Failed_Logins_Enabled and Block_Multiple_Failed_Logins_By_Ip are on, the client IP is not in Block_Multiple_Failed_Logins_Ip_Whitelist, and failed attempts recorded in ServerEvents from that IP within Block_Multiple_Failed_Logins_Time_To_Unblock_By_Ip_In_Minutes reach Block_Multiple_Failed_Logins_Attempts_Until_Block_By_Ip. A successful login from the IP resets the counter.","triggerScenarios":"Password logins (LoginWithPassword / POST /api/v1/login) from an IP that reached the failed-attempt threshold inside the unblock window — brute-force attempts, several users behind one NAT address, or a reverse proxy that reports the same IP for every client.","commonSituations":"A whole office behind NAT gets locked out after a few users mistype passwords; reverse proxy not forwarding X-Forwarded-For so getClientAddress sees only the proxy IP; password spraying from one IP; long Time_To_Unblock windows making blocks linger.","solutions":["Wait out Block_Multiple_Failed_Logins_Time_To_Unblock_By_Ip_In_Minutes, then log in once successfully to reset the counter","Add the affected IP to Block_Multiple_Failed_Logins_Ip_Whitelist (comma-separated)","Fix proxy headers so getClientAddress resolves the real client IP instead of the shared proxy address","Tune Block_Multiple_Failed_Logins_Attempts_Until_Block_By_Ip / window, or disable Block_Multiple_Failed_Logins_By_Ip if NAT makes IP blocking impractical"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await loginWithPassword(user, password);\n} catch (e) {\n  if (e instanceof Meteor.Error && e.error === 'error-login-blocked-for-ip') {\n    // stop retrying; surface 'too many attempts from your network, try later'\n    // schedule the next attempt after Block_Multiple_Failed_Logins_Time_To_Unblock_By_Ip_In_Minutes\n  }\n  throw e;\n}","preventionTips":["Add trusted NAT/office IPs to Block_Multiple_Failed_Logins_Ip_Whitelist","Ensure the reverse proxy forwards X-Forwarded-For so getClientAddress sees real client IPs","Never retry login in a tight loop; back off after consecutive failures","Enable Block_Multiple_Failed_Logins_Notify_Failed so blocks are visible"],"tags":["authentication","login","rate-limiting","brute-force-protection","reverse-proxy"],"backgroundTag":"ip-login-lockout","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}