{"record":{"id":"9efb66a5bc80912c","repo":"RocketChat/Rocket.Chat","slug":"error-login-blocked-for-user","errorCode":"error-login-blocked-for-user","errorMessage":"Login has been temporarily blocked For User","messagePattern":"Login has been temporarily blocked For User","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/auth/startup.js","lineNumber":419,"sourceCode":"\t\tApps.self?.triggerEvent(AppEvents.IPostUserCreated, { user, performedBy: options.performedBy }).catch((e) => {\n\t\t\tApps.self?.getRocketChatLogger().error({ msg: 'Error while executing post user created event', err: e });\n\t\t});\n\t}\n\n\treturn _id;\n};\n\nconst validateLoginAttemptAsync = async function (login) {\n\tlogin = await callbacks.run('beforeValidateLogin', login);\n\n\tif (!(await isValidLoginAttemptByIp(getClientAddress(login.connection)))) {\n\t\tthrow new Meteor.Error('error-login-blocked-for-ip', 'Login has been temporarily blocked For IP', {\n\t\t\tfunction: 'Accounts.validateLoginAttempt',\n\t\t});\n\t}\n\n\tif (!(await isValidAttemptByUser(login))) {\n\t\tthrow new Meteor.Error('error-login-blocked-for-user', 'Login has been temporarily blocked For User', {\n\t\t\tfunction: 'Accounts.validateLoginAttempt',\n\t\t});\n\t}\n\n\tif (login.allowed !== true) {\n\t\treturn login.allowed;\n\t}\n\n\tif (login.user.type === 'visitor') {\n\t\treturn true;\n\t}\n\n\tif (login.user.type === 'app') {\n\t\tthrow new Meteor.Error('error-app-user-is-not-allowed-to-login', 'App user is not allowed to login', {\n\t\t\tfunction: 'Accounts.validateLoginAttempt',\n\t\t});\n\t}\n","sourceCodeStart":401,"sourceCodeEnd":437,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/auth/startup.js#L401-L437","documentation":"validateLoginAttemptAsync -> isValidAttemptByUser rejects the login when Block_Multiple_Failed_Logins_Enabled and Block_Multiple_Failed_Logins_By_User are on and the target username has Block_Multiple_Failed_Logins_Attempts_Until_Block_by_User failed attempts (counted from ServerEvents) within Block_Multiple_Failed_Logins_Time_To_Unblock_By_User_In_Minutes. The username is read from login.methodArguments[0].user.username, so the block triggers even when attempts used wrong passwords for that name.","triggerScenarios":"Any login attempt as that username after the failed-attempt count reaches the threshold inside the window: password spraying against a known username, a user retrying after forgetting the password, or an automation with stale credentials hammering the account.","commonSituations":"Users typo passwords repeatedly and lock themselves out; credential-stuffing locks real usernames (an attacker can lock victims out without ever knowing the password); scripts with rotated credentials keep failing after a password change.","solutions":["Wait for Block_Multiple_Failed_Logins_Time_To_Unblock_By_User_In_Minutes to elapse, then authenticate carefully","Temporarily raise the threshold or disable Block_Multiple_Failed_Logins_By_User to recover access for the affected account","Fix the failing client (reset password, update stored credentials) so it stops incrementing the failed counter","Consider keeping By_User blocking off if it lets attackers deny service to legitimate users"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await loginWithPassword(user, password);\n} catch (e) {\n  if (e instanceof Meteor.Error && e.error === 'error-login-blocked-for-user') {\n    // account temporarily locked: show wait time, stop retries, offer password reset flow\n  }\n  throw e;\n}","preventionTips":["Rotate stale credentials in scripts/CI immediately after password changes so they stop feeding the counter","Set a moderate Block_Multiple_Failed_Logins_Attempts_Until_Block_by_User and short unblock window","Offer self-service password reset so users do not brute-force their own memory","Monitor for attackers deliberately locking usernames (denial of service)"],"tags":["authentication","login","rate-limiting","account-lockout","brute-force-protection"],"backgroundTag":"account-login-lockout","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}