ASP.Net Form Security

[Big E]

I'm using ASP.Net Form Security. I have a login page and a redirect page
etc...
What I want to do is setup some type of anti-dictionary hack code.

If someone tries to login unsuccessfully 7 times I want to send them a
custom error page. I'm not sure of the best way to check if they had tried
to login 7 times. Do I need to store in a database. I can't use session
variables because I have various apps on various servers. Can I create some
loop that counts how many times this user has attempted to logon.

Any tips or articles would be great.

Thanks.

 

[Steve C. Orr [MVP, MCSD]]

Increment a counter field for the user record in your database.
If somebody fails the login for that user x number of times, disable the
user account and contact the user to notify them that somebody may be trying
to hack into their account. If everything checks out then enable their
account again.