feat: Add login anomaly detection & suspicious activity alerts#260
Open
DebuggingMax wants to merge 1 commit intorohitdash08:mainfrom
Open
feat: Add login anomaly detection & suspicious activity alerts#260DebuggingMax wants to merge 1 commit intorohitdash08:mainfrom
DebuggingMax wants to merge 1 commit intorohitdash08:mainfrom
Conversation
Implements comprehensive login security monitoring:
Detected Anomalies:
- Brute force attack detection (multiple failed attempts)
- New IP address alerts
- New device detection (user agent fingerprinting)
- Unusual login time detection (2-5 AM)
- Impossible travel detection (rapid IP changes)
Security Features:
- Automatic account lockout after 10 failed attempts
- Self-service account unlock endpoint
- Security warnings in login response
- Full login history tracking
New Endpoints:
- GET /auth/security/summary
- GET /auth/security/login-history
- GET /auth/security/anomalies
- POST /auth/security/anomalies/{id}/resolve
- POST /auth/security/unlock
Includes comprehensive test coverage.
Closes rohitdash08#124
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements comprehensive login anomaly detection to protect user accounts from suspicious activity.
Changes
New Models (
models.py)LoginAttempt- Records all login attempts with IP, user agent, device fingerprint, timestampLoginAnomaly- Tracks detected security anomalies with type, severity, resolution statusAnomalyTypeenum - BRUTE_FORCE, NEW_IP, NEW_DEVICE, UNUSUAL_TIME, IMPOSSIBLE_TRAVELAnomalySeverityenum - LOW, MEDIUM, HIGH, CRITICALNew Service (
services/login_anomaly.py)Detection algorithms for:
Updated Auth Routes (
routes/auth.py)New Security Endpoints
GET /auth/security/summary- Security overview dashboardGET /auth/security/login-history- View recent login attemptsGET /auth/security/anomalies- List detected anomaliesPOST /auth/security/anomalies/{id}/resolve- Mark anomaly as legitimatePOST /auth/security/unlock- Self-service account unlockTests (
tests/test_login_anomaly.py)Comprehensive test coverage for all detection algorithms and endpoints.
Documentation
Updated README.md with Login Anomaly Detection section.
Acceptance Criteria
Closes #124