# Soft lock for Basic Auth

**URL:** <https://www.ruby-forum.com/t/soft-lock-for-basic-auth/222436>\
**Category:** NGINX\
**Created:** [August 28, 2012, 4:44pm UTC](https://www.ruby-forum.com/t/soft-lock-for-basic-auth/222436 "2012-08-28T16:44:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![aris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/258eb7/32.png) [@aris](https://www.ruby-forum.com/u/aris)\
**Post date:** [August 28, 2012, 4:44pm UTC](https://www.ruby-forum.com/t/soft-lock-for-basic-auth/222436/1 "2012-08-28T16:44:14Z")

</div>

Hi all,

Is it possible to apply a soft lock timeout on invalid password attempts  
for

```
        auth_basic "Login";

        auth_basic_user_file /etc/.htpasswd;

```

- Quintin

---

<div class="post-metadata">

**Author:** ![Quintin\_P](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/q/13edae/32.png) [@Quintin\_P](https://www.ruby-forum.com/u/Quintin_P)\
**Post date:** [August 31, 2012, 7:36pm UTC](https://www.ruby-forum.com/t/soft-lock-for-basic-auth/222436/2 "2012-08-31T19:36:44Z")

</div>

Hello!

On Tue, Aug 28, 2012 at 08:13:28PM +0530, Quintin P. wrote:

> Hi all,
> 
> Is it possible to apply a soft lock timeout on invalid password attempts  
> for
> 
> ```
> auth_basic "Login";
> 
> auth_basic_user_file /etc/.htpasswd;
> 
> ```

As far as I understand the question, something like this should  
work:

```
error_page 401 /401.html;

location = /401.html {
    delay 1s;
}

```

Where the “delay” directive is added by a trivial module from [1].  
(It may be equally done e.g. with embedded perl, or with  
limit\_req, but it’s usually a good idea to keep things simple.)

[1] [ngx\_http\_delay\_module: log](http://mdounin.ru/hg/ngx_http_delay_module)

Maxim D.