[Copilot]

All users were simultaneously locked out because security.py (containing AXES config) was never imported into settings.py, causing django-axes to fall back to defaults: IP-based lockout after 3 attempts. Behind a proxy, all users share one IP — any 3 failed attempts locked everyone out.

Changes

settings.py — Explicit AXES configuration

• Added AXES_LOCKOUT_PARAMETERS = ["username"]: lockouts are now scoped to the targeted username, not the shared proxy IP
• Added AXES_FAILURE_LIMIT=5, AXES_COOLOFF_TIME=1, AXES_RESET_ON_SUCCESS=True
• Moved AxesMiddleware to correct position: after SessionMiddleware, before AuthenticationMiddleware

# Before: security.py was never imported; axes defaulted to IP lockout with 3 attempts
# After (in settings.py):
AXES_LOCKOUT_PARAMETERS = ["username"]  # Per-user lockout only
AXES_FAILURE_LIMIT = 5
AXES_COOLOFF_TIME = 1
AXES_RESET_ON_SUCCESS = True

users/views.py — Login rate limiting

• Changed @ratelimit(key="ip") → key="post:username" on the login view; rate lowered to 6/m to align with AXES_FAILURE_LIMIT

security_middleware.py — BasicRateLimitMiddleware

• Login rate limiting now keys by username instead of IP
• Added IP-based fallback for requests missing a username (to prevent bypass)
• Reads AXES_FAILURE_LIMIT from settings instead of hardcoding 5

users/tests.py

• Added AccountLockoutTestCase covering: one user's failures don't lock others from the same IP, per-user counter independence, and lockout after limit is reached

Original prompt

All users keep getting locked out of their accouts. All users always at the same time. So could be some middleware problem that locks all users. Either fix or disable this because it happens to often. Investigate code, plan fix and implement. Test your fix thouroighly before finishing

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.