The Login Endpoint — Where Brute Force Begins

import asyncio
from fastapi import FastAPI, Form, Request
from fastapi.responses import RedirectResponse, Response

app = FastAPI()

@app.post("/login")
async def login(request: Request, pin: str = Form(...)):
    ip = client_ip(request)

    # Pre-check: blacklist (defense in depth; middleware also blocks)
    if is_blacklisted(ip):
        return Response("Forbidden", status_code=403)

    # Pre-check: too many fails already?
    if attempt_count(ip) >= max_retry():
        blacklist(ip, reason="exceeded_retry")
        return Response("Locked out", status_code=429)

    # Verify PIN
    cfg = load_config()
    if not verify_pin(pin, cfg["pin_hash"]):
        increment_attempt(ip)
        # Constant-time response: don't leak 'PIN was wrong' vs 'user not found'
        await asyncio.sleep(0.5)        # also blunts timing attacks
        return Response("Invalid PIN", status_code=401)

    # Success: clear the counter, issue the session
    clear_attempts(ip)
    token    = create_session(ip)
    response = RedirectResponse("/", status_code=302)
    response.set_cookie(
        "session", token,
        max_age=cfg["session_seconds"],
        httponly=True, secure=True, samesite="strict", path="/"
    )
    return response

<form method="POST" action="/login" autocomplete="off">
  <input
    name="pin"
    type="password"
    inputmode="numeric"
    pattern="[0-9]*"
    maxlength="4"
    autofocus
    autocomplete="off"
  />
  <button type="submit">Unlock</button>
</form>