# Brute Force Detection

**URL:** <https://forum.keycloak.org/t/brute-force-detection/5887>\
**Category:** Getting advice\
**Tags:** authentication\
**Created:** [November 10, 2020, 9:46am UTC](https://forum.keycloak.org/t/brute-force-detection/5887 "2020-11-10T09:46:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mohankumar.d](https://avatars.discourse-cdn.com/v4/letter/m/4da419/32.png) [@mohankumar.d](https://forum.keycloak.org/u/mohankumar.d)\
**Post date:** [November 10, 2020, 9:46am UTC](https://forum.keycloak.org/t/brute-force-detection/5887/1 "2020-11-10T09:46:29Z")

</div>

Hi Team,

We start using Keycloak as Identity and access management for our new project design and enabled Brute Force Detection for my newly created Realm.

It’s working, but in my use-case, I have to notify my user they have to wait another 30min to try login again since they have reached Max Login Failure. But I got ‘invalid\_grant’ as error same message whenever I try with the wrong / correct password after max failure reached.

{  
“error”: “invalid\_grant”,  
“error\_description”: “Invalid user credentials”  
}

How do I different the response message to notify my users?

---

<div class="post-metadata">

**Author:** ![vju42](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/vju42/32/1143_2.png) [@vju42](https://forum.keycloak.org/u/vju42)\
**Post date:** [November 10, 2020, 12:15pm UTC](https://forum.keycloak.org/t/brute-force-detection/5887/2 "2020-11-10T12:15:23Z")

</div>

Hi, it is best practice to not provide any useful information in case of a failed login to the user.  
I think thats what they implement.  
On the other hand, if an account is locked temporarily, there is clearly value to inform the user about a reason.  
One option would be to catch the login (failed) event on the server and notify the user via email. Email would be a different channel and not provide details to the hacker / bot, but on the other hand inform the user and provide him with actions.  
I’d recommend to create a feature request for this - I believe it should be there as an option to allow the user to know “come back later”. Another solution would be to request a captcha or similar to keep the bad ones out.

---

<div class="post-metadata">

**Author:** ![mohankumar.d](https://avatars.discourse-cdn.com/v4/letter/m/4da419/32.png) [@mohankumar.d](https://forum.keycloak.org/u/mohankumar.d)\
**Post date:** [November 10, 2020, 1:06pm UTC](https://forum.keycloak.org/t/brute-force-detection/5887/3 "2020-11-10T13:06:19Z")

</div>

How do we create a new feature request?

---

<div class="post-metadata">

**Author:** ![vju42](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/vju42/32/1143_2.png) [@vju42](https://forum.keycloak.org/u/vju42)\
**Post date:** [November 10, 2020, 1:37pm UTC](https://forum.keycloak.org/t/brute-force-detection/5887/4 "2020-11-10T13:37:34Z")

</div>

See here: [https://www.keycloak.org/community](https://www.keycloak.org/community)