# Limit failed attempts with BLOCKED

> Count attempts per IP address with BLOCKED() and answer 429 once the limit is reached, for logins and password resets.

Framework: total5
Product: Total.js 5 (total5@0.0.19)
Language: en
Content-SHA256: 7e8fac3c4d653cf0d6f7b29e6b60cac123f37a0805deb8184eb6ac990cb10230
Snapshot: c0700e321579725c5cf4f5ace1ad7d2866d1b4f93c24a63c0b41b6b7998e976c
Sources: total5-installed@total5@0.0.19
Review: not-recorded

`BLOCKED($, limit, expiration)` counts calls per IP address. It returns `true` once the address has made more than `limit` calls within the expiration (default: 5 calls in 15 minutes), and `undefined` before that. Call it at the start of a sensitive handler and stop when it returns `true`. To forgive an address after a successful login call `BLOCKED($, -1)`.

The counters live in the memory of the process; behind a reverse proxy make sure the real client address reaches Total.js, otherwise everybody shares one counter.

```js controllers/login.js
exports.install = function() {
	ROUTE('POST /login/', login);
};

function login($) {

	if (BLOCKED($, 3, '1 minute')) {
		$.invalid(429);
		return;
	}

	if ($.body.password === 'correct') {
		BLOCKED($, -1);
		$.json({ ok: true });
	} else
		$.invalid(401);
}
```