{"record":{"id":"7f78cf836da19ca3","repo":"apereo/cas","slug":"access-denied-for-user-username-from-ip-addre","errorCode":null,"errorMessage":"Access Denied for user [${username}] from IP Address [${request.getRemoteAddr()}]","messagePattern":"Access Denied for user \\[(.+?)\\] from IP Address \\[(.+?)\\]","errorType":"http","errorClass":null,"httpStatus":423,"severity":"warning","filePath":"core/cas-server-core-authentication-throttle/src/main/java/org/apereo/cas/throttle/DefaultThrottledRequestResponseHandler.java","lineNumber":35,"sourceCode":" * @author Misagh Moayyed\n * @since 6.0.0\n */\n@RequiredArgsConstructor\n@Slf4j\npublic class DefaultThrottledRequestResponseHandler implements ThrottledRequestResponseHandler {\n    private final String usernameParameter;\n\n    @Override\n    public boolean handle(final HttpServletRequest request, final HttpServletResponse response) {\n        return FunctionUtils.doUnchecked(() -> {\n            val username = StringUtils.isNotBlank(this.usernameParameter)\n                ? StringUtils.defaultIfBlank(request.getParameter(this.usernameParameter), \"N/A\")\n                : \"N/A\";\n            val msg = \"Access Denied for user [\"\n                      + StringEscapeUtils.escapeHtml4(username) + \"] from IP Address [\"\n                      + request.getRemoteAddr() + ']';\n            response.sendError(HttpStatus.SC_LOCKED, msg);\n            LOGGER.warn(msg);\n\n            return false;\n        });\n    }\n}\n","sourceCodeStart":17,"sourceCodeEnd":41,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-authentication-throttle/src/main/java/org/apereo/cas/throttle/DefaultThrottledRequestResponseHandler.java#L17-L41","documentation":"DefaultThrottledRequestResponseHandler responds to a throttled (rate-limited) request by sending HTTP 423 (SC_LOCKED) with an 'Access Denied for user [x] from IP Address [y]' message. It is the standard CAS authentication-throttle rejection, not a bug in your code — the client exceeded the configured failure threshold.","triggerScenarios":"A request matches the throttled-request filter/handler (e.g., repeated failed login or password-reset attempts) and DefaultThrottledRequestResponseHandler.handle invokes response.sendError(423, msg).","commonSituations":"User repeatedly failing authentication triggers the throttle; shared NAT IP causing many users to trip the limit; threshold/window configured too aggressively; automated health checks hitting throttled endpoints.","solutions":["Wait for the throttle window to expire or clear the throttle store (in-memory/map/JDBC)","Raise cas.authn.throttle.* thresholds/window or reduce false positives in the failure criteria","Exclude trusted IPs/health-check paths from throttling and ensure username extraction (usernameParameter) is correct"],"exampleFix":"// before\ncas.authn.throttle.failure-threshold=3\ncas.authn.throttle.failure-range-seconds=60\n// after\ncas.authn.throttle.failure-threshold=10\ncas.authn.throttle.failure-range-seconds=60","handlingStrategy":"retry","validationCode":"// client-side: back off and retry after the throttle window, not immediately\nlong waitSeconds = throttleWindowSeconds;","typeGuard":null,"tryCatchPattern":"// client\ntry { response = http.send(req); } catch (HttpResponseException e) { if (e.getStatusCode() == 423) { Thread.sleep(windowMs); retry(); } }","preventionTips":["Configure realistic thresholds and windows for throttle filters","Clear/expire throttle state via the configured repository rather than blocking users indefinitely","Exclude monitoring/health endpoints from throttling"],"tags":["throttling","rate-limit","http-423","access-denied","brute-force"],"backgroundTag":"rate-limit-exceeded","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}