# Authentication Attempt Rate Limiting

Authentication attempt rate limiting provides additional protection against repeated failed authentication attempts.

## Configure Authentication Attempt Rate Limiting

Configure authentication attempt rate limiting in the `nexus.properties` file.

```
nexus.auth.ratelimit.enabled=true
nexus.auth.ratelimit.max-attempts=3
nexus.auth.ratelimit.base-delay-seconds=30
nexus.auth.ratelimit.max-delay-seconds=900
nexus.auth.ratelimit.max-tracked-keys=10000
```

After updating these properties, restart Nexus Repository.

## Configuration Properties

The following properties are available for authentication attempt rate limiting:

| Property | Description | Default | Valid values |
| --- | --- | --- | --- |
| `nexus.auth.ratelimit.enabled` | Enables or disables authentication attempt rate limiting. Set to `false` to disable rate limiting. | `true` | `true` or `false` |
| `nexus.auth.ratelimit.max-attempts` | Number of consecutive failed authentication attempts before rate limiting is applied. | `3` | Positive values |
| `nexus.auth.ratelimit.base-delay-seconds` | Base delay, in seconds, used when calculating the rate-limit timeout. | `30` | Positive values |
| `nexus.auth.ratelimit.max-delay-seconds` | Maximum delay, in seconds, that can be applied by rate limiting. | `900` | Positive values |
| `nexus.auth.ratelimit.max-tracked-keys` | Maximum number of unique users or tokens the rate limiter tracks simultaneously in memory. | `10000` | Positive values |

## Authentication Scope

Authentication attempt rate limiting applies to:

- HTTP Basic authentication
- Token-based authentication

For SAML/SSO authentication, authentication is handled by the identity provider (IdP). Authentication attempt rate limiting does not apply to the SAML/SSO login process.

## Rate-Limit Response

When authentication attempts are rate limited, Nexus Repository returns HTTP status code `429 Too Many Requests`.

The response includes a `Retry-After` header.

## Example Configuration and Behavior

Example configuration:

```
nexus.auth.ratelimit.max-attempts=5
nexus.auth.ratelimit.base-delay-seconds=30
nexus.auth.ratelimit.max-delay-seconds=3600
```

For a user with repeated failed authentication attempts:

| Attempt | Result | Retry Delay |
| --- | --- | --- |
| 1–5 | Allowed | - |
| 6 | Blocked | 30 seconds |
| 7 | Blocked | 60 seconds |
| 8 | Blocked | 120 seconds |
| 9 | Blocked | 240 seconds |
| 10 | Blocked | 480 seconds |
| … | … | … |
| 18+ | Blocked | 3600 seconds |

- Each blocked attempt increments the failure counter.
- A successful authentication clears the counter immediately.
- In clustered deployments, each node maintains an independent rate-limit state.

## Monitoring

Authentication attempt rate limiting events are recorded in the audit log under the following domain:

```
security.auth.ratelimit
```

## High Availability Deployments

Authentication attempt rate limiting state is maintained in memory and is not shared across cluster members.

**Note**

Use positive values for authentication attempt rate limiting configuration properties.