> For the complete documentation index, see [llms.txt](https://docs.toomuchmedia.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.toomuchmedia.com/nats-admin/members/login-protection.md).

# Login Protection

*Article Topics:* [*Members*](/getting-started/common-topics/members.md)

The Login Protection page lists banned and whitelisted members, allowing you to manage member access efficiently. It provides detailed information on ban and whitelist actions, including the reasons, timestamps, and whether the action was performed automatically or by an admin.

<figure><img src="https://2232071635-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWJVne6meHqGT8rzsBdod%2Fuploads%2FyP2KQ5vJ6A6fQTZVGQWr%2Fimage.png?alt=media&amp;token=a9a6d1ad-5557-4ae6-beb8-2d0dc6f5ae66" alt=""><figcaption></figcaption></figure>

## Table Details

The Bans/Whitelist table has pieces of information that are associated with a recorded Ban or Whitelist action, such as:

* **Member:** The Member who is Banned or Whitelisted.
* **Start:** The effective start time of the Ban or Whitelist.
* **End:** The effective end time of the Ban or Whitelist.
* **Status:** Whether the ban or whitelist is still active or has finished.
* **Added By:** The name of the administrator or system that enforced the ban, along with the reasoning.
* **Actions:** The action to perform on the specific Ban or Whitelist, whether that is to:
  * Update: Modify the Reasoning and/or End date.
  * Remove: Remove the ban or whitelist.

## Adding a Ban

To add a new ban, ensure you have the "**Bans**" tab highlighted, then click the "Add Ban" button at the top-right of the page. This will display a widget where you can search for a member by their ID or username, provide an optional reason for the ban, and select the end time for the ban.

<figure><img src="https://2232071635-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWJVne6meHqGT8rzsBdod%2Fuploads%2FeikckJxCS7scGYsMVcDs%2Fimage.png?alt=media&amp;token=78ac533b-4202-4514-aa63-91666cf1be5e" alt=""><figcaption></figcaption></figure>

## Adding a Whitelist

To add a new whitelist, ensure the Whitelist tab is highlighted, then click the "Add Whitelist" button at the top-right of the page. This will display a widget where you can search for a member by their ID or username, optionally provide a reason for the whitelist, and select the whitelist end time.

<figure><img src="https://2232071635-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWJVne6meHqGT8rzsBdod%2Fuploads%2FVC9ei6XfJ4S6acc1zUM9%2Fimage.png?alt=media&amp;token=a860f6e8-6c18-4e97-9fc3-33e93e3b2166" alt=""><figcaption></figcaption></figure>

## External Login Protection using REST API

{% hint style="info" %}
**Please note:** This assumes you have OpenID connected and loginlog functioning on member records; if not, [you will need to set this up first](/nats-admin/members/further-reading/openid-connect.md).
{% endhint %}

This section explains how to use the NATS REST API to use Login Protection (Password Sharing Prevention) logic in external member applications and non-CMS systems.

#### Required Endpoints

| Action           | Method | Endpoint                       | Description                                                            |
| ---------------- | ------ | ------------------------------ | ---------------------------------------------------------------------- |
| **Check List**   | `GET`  | `/api/member/login_list_check` | Checks if a member is currently on the banned or whitelist.            |
| **Count IPs**    | `GET`  | `/api/member/login_ips`        | Returns unique IP addresses used by the member within the scan window. |
| **Ban Member**   | `POST` | `/api/member/ban`              | Explicitly bans a member for password sharing or security violations.  |
| **Record Login** | `POST` | `/api/member/login`            | Logs a successful login or a denied attempt in NATS.                   |

### Workflow

To replicate NATS' internal login protection logic in an external system, follow these steps during authentication:

#### **1. Check for Existing Restrictions**

Before allowing authentication, verify whether the member is currently banned.

**Request:** `GET /api/member/login_list_check?memberid=123&list=banned`

* **Response (Not Banned):** `{"result": false}`
* **Response (Banned):** Returns the active ban record details. If a ban is active, **deny login access** .

If no active ban exists, check if the member is whitelisted: `GET /api/member/login_list_check?memberid=123&list=whitelist`

* If whitelisted (`"result"` contains an entry record), skip automated IP limit checks and **proceed directly to Step 4 (Record Login)**.

{% content-ref url="/pages/22a80e22d233c90c46787ab2fb801e4273fecf53" %}
[/api/member/login\_list\_check](/api/api-endpoints/member/api-member-login_list_check.md)
{% endcontent-ref %}

#### **2. Verify Unique IP Count**

If the member is not whitelisted, retrieve the list of unique IP addresses used by the member within the configured scan window (`MEMBER_LOGIN_PROTECTION_SCAN_WINDOW_HOURS`).

**Request:** `GET /api/member/login_ips?memberid=123`

**Response Example:**

```json
{
  "result": [
    "192.168.1.10",
    "10.0.0.15",
    "172.16.0.4"
  ]
}
```

Count the total number of unique IPs returned (including the current user's IP address if it is not already present in the list). Compare this count against your configured limit (`MEMBER_LOGIN_PROTECTION_ALLOWED_IPS_COUNT`).

{% content-ref url="/pages/d73c66becd767150bef0b8f59c2bcff4fe763d9e" %}
[/api/member/login\_ips](/api/api-endpoints/member/api-member-login_ips.md)
{% endcontent-ref %}

#### **3. Trigger Ban (If Limit Exceeded)**

If the unique IP count exceeds your allowed limit, issue a ban via the API.

**Request:** `POST /api/member/ban`

**Body:**

{% code overflow="wrap" %}

```json
{
  "memberid": 123,
  "add_reason": "Logged in from more than 5 unique IPs within 24 hours"
}
```

{% endcode %}

**Response Example:**

{% code overflow="wrap" %}

```json
{
  "result": "success",
  "message": "Member banned successfully"
}
```

{% endcode %}

{% content-ref url="/pages/05928ce618056f06222bca6df1d635c40c6a2b80" %}
[/api/member/ban](/api/api-endpoints/member/api-member-ban.md)
{% endcontent-ref %}

#### 4. Record the Attempt

Regardless of success or failure, record the activity to maintain accurate logs.

**For Successful Login:**

**`POST /member/login`**

**Body:**

{% code overflow="wrap" %}

```json
{
  "username": "member_user",
  "siteid": 1,
  "ip": "4.4.4.4",
  "description": "Login successful"
}
```

{% endcode %}

**For Denied/Banned Attempt:**

`POST /member/login`

**Body:**

{% code overflow="wrap" %}

```
{
  "username": "member_user",
  "siteid": 1,
  "ip": "4.4.4.4",
  "description": "Login Protection: Member ban detected"
}
```

{% endcode %}

{% content-ref url="/pages/209f1bef386965f6cb006fbc33f40b8c131dcd36" %}
[/api/member/login](/api/api-endpoints/member/api-member-login.md)
{% endcontent-ref %}

## Related Articles

{% content-ref url="/pages/dkxu26EhpOuktINDGcuc" %}
[Member Overview](/nats-admin/members/member-overview.md)
{% endcontent-ref %}

{% content-ref url="/pages/uiooj2nhq58MF6kad0iF" %}
[Password Sharing Prevention](/nats-admin/members/login-protection/password-sharing-prevention.md)
{% endcontent-ref %}