Brute Force Attack in Flask (Python)
Brute Force Attack in Flask with Python — how this specific combination creates or exposes the vulnerability
Flask applications often expose authentication endpoints such as login or password reset via simple route decorators. When these endpoints lack rate limiting or account lockout mechanisms, they become susceptible to brute force attacks. An attacker can automate repeated login attempts using tools like Hydra or custom Python scripts, guessing passwords until success. Because Flask is lightweight and does not enforce security controls by default, developers must explicitly add protections. Without them, the application’s unauthenticated attack surface remains open, allowing credential guessing that can lead to account takeover, especially if weak passwords are used. middleBrick detects this risk during its unauthenticated scan by observing response patterns under rapid request sequences, flagging missing rate limiting as a finding under the 'Rate Limiting' check.
Python-Specific Remediation in Flask — concrete code fixes
To mitigate brute force attacks in Flask, implement rate limiting using the Flask-Limiter extension. This limits login attempts per IP or username within a time window. Below is a syntactically correct example showing how to protect a login route. After five failed attempts, further requests are blocked for 15 minutes. This approach does not block legitimate users immediately but thwarts automated guessing. middleBrick validates such controls by testing the endpoint with repeated requests and verifying that responses change (e.g., 429 Too Many Requests) after the threshold.
from flask import Flask, request, jsonify
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address
app = Flask(__name__)
limiter = Limiter(
app,
key_func=get_remote_address,
default_limits=["200 per day", "50 per hour"]
)
@app.route('/login', methods=['POST'])
@limiter.limit("5 per minute")
def login():
username = request.form.get('username')
password = request.form.get('password')
# Validate credentials (example only — never store plaintext passwords)
if username == 'admin' and password == 'secure123':
return jsonify({'message': 'Login successful'}), 200
else:
return jsonify({'message': 'Invalid credentials'}), 401
if __name__ == '__main__':
app.run(debug=False)
For stronger protection, combine IP-based limiting with username-based tracking to prevent attackers from bypassing limits by rotating IPs. Store failed attempts in a cache like Redis and reset on success. middleBrick’s scan includes checks for both authentication bypass and rate lifting, helping verify that such mitigations are effective in practice.