I think about what is the best practice of implementing account lockout, when user attpemt to login more than X times in Y duration (and fails).
Should I block the IP address that trying to login and keep it in my db? or to lock the "username" that attempt to login? or the implementation needs to be in the browser as a flag (like cookie, local / session storage) that would prevent the request at all?
Would love to get your suggestions.
Eliran.