Interface AbuseDetectionService

All Known Implementing Classes:
InMemoryAbuseDetectionService
public interface AbuseDetectionService
Multi-dimensional abuse detection contract.

Two-call flow

Callers ask evaluate(AbuseAttemptContext) before performing the credential operation. The decision says whether the call may proceed, must wait, must hit a step-up check, or must be blocked. After the credential operation completes (success or failure), the caller hands the outcome back through recordOutcome(AbuseAttemptContext, AttemptOutcome) so the counters update.

Cluster note

The in-memory reference implementation (InMemoryAbuseDetectionService) keeps state on the JVM heap — multi-node deployments must replace it with a clustered store (Redis, Hazelcast, Postgres) so a coordinated attack cannot dodge the limits by hopping nodes. The Konzept §13 calls this out as a production requirement.

No leak

Decisions stay generic; exact counters and per-dimension specifics never reach the perimeter (CWE-203 / CWE-307).

  • Method Details

    • evaluate

      AbuseDecision evaluate(AbuseAttemptContext context)
      Decides what reaction the caller should apply before running the credential operation.

    • recordOutcome

      void recordOutcome(AbuseAttemptContext context, AttemptOutcome outcome)
      Records the outcome of the operation so the counters can update. Successful logins typically reset the per-username failure counter; volume counters (CLIENT_ADDRESS / TENANT / GLOBAL) usually keep tracking irrespective of outcome.