Hardening a Django login the boring way

Security features fail when they are exciting. The boring stack works:

1. Lockout after repeated failures, stored in the database.
2. Audit log for every attempt.
3. Headers set by middleware, not by hope.

if recent_failures >= MAX_ATTEMPTS:
    return HttpResponseForbidden("Too many attempts.")

The rest of this post is sample content — write the real one in the Command Center.