[freeRetries] strange behavior

Hello,

thanks for that great module!

However I am facing a strange behavior regarding the number of freeRetries.

Indeed my snippet of code is the following:

options = { freeRetries: 10,
            minWait: 25*60*60*1000,
            maxWait: 25*60*60*1000,
            proxyDepth: 1,
            failCallback: function(req, res, next, nextValidRequestDate) {
              res.status(429).send('You have made too many failed attempts in a short period of time, please try again ' + moment(nextValidRequestDate).fromNow());
            }},
bruteforce = new ExpressBrute(bruteRedisStore, options);

In that case what happen:

After only 5 requests (whatever the time between each) I got: You have made too many failed attempts in a short period of time, please try again in a few seconds

A retry passed few second still does not reset the “counter”.

I was expecting to reach 10 -> banned -> retry after ~10 sec -> OK -> retry fail etc… with gradually increasing waiting time.

I might not have understood exactly the behavior of the module I think. If you got some time to explain me what is wrong in my thinking I would be very thankful!

Cheers!

[AdamPflug]

The correct behavior for that config is: reach 10 -> banned -> retry after ~10 seconds -> fail -> retry after 25 hours -> OK.

As for why it’s failing after 5, can you include a snippet of how you’re using the middleware, it almost sounds like it’s being included twice.

[AdrienFromToulouse]

I am not a security expert but I don’t think express-brute should change anything. May be this issue can be closed. Thanks for your time!