octobercms/october · error · ApplicationException

Too many password reset attempts, please try again in :secon

Error message

Too many password reset attempts, please try again in :seconds seconds.

What it means

Error "Too many password reset attempts, please try again in :seconds seconds." thrown in octobercms/october.

Source

Thrown at modules/backend/controllers/Auth.php:188

     * handleSubmitRestore submits the restore form
     */
    protected function handleSubmitRestore()
    {
        $rules = [
            'login' => 'required|between:2,255'
        ];

        $validation = Validator::make(post(), $rules, [], ['login' => __('Username')]);

        if ($validation->fails()) {
            throw new ValidationException($validation);
        }

        // Throttle reset requests by IP to limit email flooding and slow
        // username enumeration via timing analysis.
        $limiter = new RateLimiter('backend.auth.restore');
        if ($limiter->tooManyAttempts(5)) {
            throw new ApplicationException(__("Too many password reset attempts, please try again in :seconds seconds.", [
                'seconds' => $limiter->availableIn()
            ]));
        }

        $limiter->increment(600);

        $user = BackendAuth::findUserByLogin(post('login'));

        if (!$user) {
            // For security reasons, only show detailed error when debug mode is on
            if (System::checkDebugMode()) {
                throw new ValidationException([
                    'login' => __("A user could not be found with a login value of ':login'", ['login' => post('login')])
                ]);
            }
        }
        else {
            // User found, send reset email

View on GitHub (pinned to b608633a7e)

When it happens

Trigger: Thrown at modules/backend/controllers/Auth.php:188 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of octobercms/october@b608633a7e (2026-08-21). Data as JSON: /api/errors/ec2ac172c51254e0. Report an issue: GitHub.