## 28) Login failure delay can enable app-layer DoS

Docs/Features.md

@@ -43,7 +43,7 @@ A web application to monitor, manage, and configure fail2ban from a clean, acces
 - The login endpoint (`POST /api/auth/login`) is protected against brute-force attacks with per-IP rate limiting.
 - **Rate limit:** 5 login attempts per minute per IP address.
 - When the limit is exceeded, the server returns **HTTP 429 Too Many Requests** with a `Retry-After` header indicating when requests will be accepted again.
-- Each failed login attempt triggers a 10-second delay on the server side to further slow down attack attempts, on top of the bcrypt password hashing cost.
+- Each failed login attempt triggers a progressive server-side delay (exponential back-off from 1 to 10 seconds) to further slow down attack attempts, on top of the bcrypt password hashing cost. The penalty grows with consecutive failures and resets after the rate-limit window expires.
 - The rate limiter tracks attempts in memory per IP, ensuring that rapid-fire attacks from a single source are quickly throttled.
 
 ---