Security Settings

The Security section of the Console provides controls for protecting your Auris tenant against unauthorized access, credential stuffing, brute-force attacks, and automated abuse. All security protections operate at the platform level and apply across all applications in your tenant.

Access Security Settings via Console → Settings → Security.

IP Allow / Block Lists

IP rules let you explicitly permit or deny login attempts from specific IP addresses or CIDR ranges. Rules are evaluated before authentication, meaning a blocked IP is rejected before any credentials are checked.

How Rules Work

Auris evaluates IP rules in the following order:

1. Block rules are checked first. If the incoming IP matches any block rule, the request is rejected immediately.
2. Allow rules are checked next. If the tenant has any allow rules configured and the incoming IP does not match any allow rule, the request is rejected.

This means:

• If you have no IP rules, all IPs are permitted
• If you have only block rules, all IPs except those blocked are permitted
• If you have any allow rules, only IPs matching those allow rules are permitted (plus any explicitly blocked rules override the allow rules)

Rule Scope

Adding an IP Rule

Common Use Cases

• Block a known bad actor’s IP range: Add a block rule for the attacker’s CIDR range
• Restrict an admin application to office IPs: Add allow rules for your office IP ranges and set scope to the admin application
• Temporary access for a contractor: Add a temporary allow rule that expires after their engagement ends

Brute-Force Protection

Brute-force protection automatically locks out user accounts after a configured number of consecutive failed login attempts. This defends against password guessing and credential stuffing attacks.

Configuration

Go to Settings → Security → Brute-Force Protection.

Lockout Duration Multiplier

When set above 1, each subsequent lockout for the same account increases the lockout duration:

• First lockout: 15 minutes
• Second lockout (multiplier = 2): 30 minutes
• Third lockout: 60 minutes
• And so on

This escalation policy makes repeated automated attacks progressively more expensive.

Managing Locked Accounts

The Locked Accounts table on the Brute-Force Protection page shows all currently locked accounts:

Manual Unlock

Click Unlock next to any account to immediately release the lockout without waiting for the timer. Use this when a legitimate user contacts support after being locked out.

Suspicious Login Detection

Suspicious login detection analyzes each successful login for behavioral signals that may indicate account compromise. Unlike brute-force protection (which triggers on failures), suspicious login detection runs after authentication succeeds.

Detection Methods

Enable or disable each detector independently:

Actions Per Detection

For each detection type, configure what happens when a suspicious login is detected:

You can set different actions for different detection types. A recommended starting configuration:

Impossible Travel Configuration

GeoIP Providers

To use MaxMind, enter your MaxMind license key in the GeoIP configuration and Auris will use the MaxMind API for lookups.

Reviewing Suspicious Login Events

Go to Settings → Security → Suspicious Logins to see a table of all detected events:

Click any event to see full details including the source IP, resolved location, device fingerprint, and the previous login data that triggered the anomaly.

Mark events as reviewed to track which suspicious logins have been investigated.

CAPTCHA

CAPTCHA integration adds a bot challenge to specified authentication pages, reducing automated account creation, login abuse, and credential stuffing attacks.

Supported Providers

Configuration

Rate Limiting

Auris applies sliding-window rate limiting to all API endpoints to prevent abuse and protect against denial-of-service conditions. Rate limiting is configured at the platform level and is not fully customizable from the Console, but the current limits are visible in the Console.

Rate Limit Tiers

Go to Settings → Security → Rate Limiting to view the current configuration:

Rate Limit Response Headers

When a rate limit is applied, the API returns HTTP 429 Too Many Requests with standard headers:

X-RateLimit-Limit: 10
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1736000000
Retry-After: 60

Note: Rate limit thresholds are configurable at the infrastructure level in apps/api/.env. The Console page is read-only and shows the currently active configuration.

Attack Protection Dashboard

Go to Settings → Attack Protection for an overview dashboard showing security activity across all protection layers:

• Recent Blocked Attempts: Timeline chart of IP-blocked requests over the last 7 days
• Brute-Force Lockouts: Count of account lockouts, most targeted accounts
• Suspicious Login Events: Count by severity, actions taken
• CAPTCHA Failures: Rate of requests rejected by CAPTCHA score threshold

Use this dashboard during a suspected attack to monitor protection effectiveness in real time.

Related Guides

• Suspicious Login Detection — Technical Reference — How GeoIP lookup and impossible travel detection work
• Adaptive MFA — Risk-score-based MFA enforcement
• IP Rules API — Manage IP rules programmatically via the REST API
• CAPTCHA Integration — Developer guide for custom CAPTCHA integration