* Roundup Robot  [2021-02-21 22:25 +0100]: 
>New changeset 090dc40da49d by Cédric Krier in branch 'default':
>Add default value for new device_cookie
>https://hg.tryton.org/trytond/rev/090dc40da49d

Which consumer code is impacted?

I had thought about adding a default value to those functions but
decided not to put them because it would mean that any successful
login would reset the count for unknown devices.

We get sometimes the remark that the exponential wait in the get_login function when the user enters is useless or should be changed in order to reduce the delay (see issue5375 and other discussions about that on the opensuse bugtracker or in live).

Getting some idea from https://owasp.org/www-community/Slow_Down_Online_Guessing_Attacks_with_Device_Cookies we think that we could use a random token store on the client side and on the server side in order to reduce the wait for users trying to connect from a client that has already been trusted.

This token would be sent alongside the credentials information and if it matches the one store on the server then the user wouldn't have to wait in order to make another attempt. Of course if the number of attempts reach a defined limit then we will sent a 429 - Too Many Requests.