# Login & Auth Protection

Login endpoints are a prime target for credential stuffing and brute-force attacks — and unlike a contact form, a compromised login has a direct payoff for an attacker, so it's worth protecting more tightly than a general-purpose form.

## What you're defending against

- **Brute-force / credential stuffing** — scripted, high-volume login attempts, often testing leaked credential lists against your login endpoint.
- **Account takeover** — a successful login from a location, device, or network that doesn't match the account's normal pattern.
- **Compromise via impossible travel** — a session that logs in from two distant locations within a timeframe that isn't realistically possible, which usually means a stolen credential or session is in play.

## Recommended configuration

1. **Enable [Adaptive Captcha](/docs/sentinel/features/adaptive-captcha/)** on the login form's [Security Group](/docs/sentinel/configure/security-groups/) — it detects suspicious login attempts and escalates automated ones to a Code Challenge, without adding friction for normal logins.
2. **Add a [Rate Limiter](/docs/sentinel/features/rate-limiters/)** on the login endpoint, scoped per IP (and per account/username if your login flow can key on it), to cap how many attempts are allowed in a given window — this is what actually stops a brute-force run.
3. **Enable an [IP Resolver](/docs/sentinel/integrations/ip-resolvers/)** and [Threat Intelligence](/docs/sentinel/features/threat-intelligence/) so known proxies, Tor exit nodes, and IPs already flagged by threat feeds get scrutinized before they reach your login logic.
4. **Use [Classifier](/docs/sentinel/features/classifier/#using-the-api)'s fast-traveler detection** to catch impossible-travel logins: pass the login request's `ip` and `timeZone`, along with `lastKnownLocation` from the account's last successful login, and Classifier's `LOCATION_DISTANCE` / `TIMEZONE_MISMATCH` rules will flag logins that don't add up.
5. **Keep [Autopilot](/docs/sentinel/features/autopilot/) on** so difficulty adapts automatically if you see a credential-stuffing spike.

## Integration steps

1. Add the [ALTCHA widget](/docs/integration/widget/) to your login (and registration) form.
2. Make sure Adaptive Captcha is enabled on that form's Security Group.
3. In your login handler, after verifying the ALTCHA payload (see [Server Integration](/docs/integration/server/)), call the Classifier API with the request's IP and timezone to get a risk signal before completing the login — and store the location for next time, so fast-traveler detection has something to compare against.

## Related

- [User Registration Protection](/docs/sentinel/use-cases/user-registration-protection/) — the sign-up flow that usually precedes this one.
- [Secure Form Submissions](/docs/sentinel/use-cases/secure-form-submissions/)
- [Rate Limiters](/docs/sentinel/features/rate-limiters/)
- [Threat Intelligence](/docs/sentinel/features/threat-intelligence/)
- [Classifier](/docs/sentinel/features/classifier/)