user lockout in asp.net core

Author: nitish-kaushik

Diff for: Webgentle.BookStore/Webgentle.BookStore/Controllers/AccountController.cs

@@ -75,6 +75,10 @@ public async Task<IActionResult> Login(SignInModel signInModel, string returnUrl
                 {
                     ModelState.AddModelError("", "Not allowed to login");
                 }
+                else if (result.IsLockedOut)
+                {
+                    ModelState.AddModelError("", "Account blocked. Try after some time.");
+                }
                 else
                 {
                     ModelState.AddModelError("", "Invalid credentials");

Diff for: Webgentle.BookStore/Webgentle.BookStore/Repository/AccountRepository.cs

@@ -76,7 +76,7 @@ public async Task GenerateForgotPasswordTokenAsync(ApplicationUser user)
 
         public async Task<SignInResult> PasswordSignInAsync(SignInModel signInModel)
         {
-            return await _signInManager.PasswordSignInAsync(signInModel.Email, signInModel.Password, signInModel.RememberMe, false);
+            return await _signInManager.PasswordSignInAsync(signInModel.Email, signInModel.Password, signInModel.RememberMe, true);
         }
 
         public async Task SignOutAsync()

Diff for: Webgentle.BookStore/Webgentle.BookStore/Startup.cs

@@ -49,6 +49,14 @@ public void ConfigureServices(IServiceCollection services)
                 options.Password.RequireUppercase = false;
 
                 options.SignIn.RequireConfirmedEmail = true;
+
+                options.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(20);
+                options.Lockout.MaxFailedAccessAttempts = 3;
+            });
+
+            services.Configure<DataProtectionTokenProviderOptions>(options =>
+            {
+                options.TokenLifespan = TimeSpan.FromMinutes(5);
             });
 
             services.ConfigureApplicationCookie(config =>