Michael Root's Blog

JSF - Rendering Images stored in Database

mroot — Mon, 03 Nov 2008 17:00:36 +0000

by Michael Root

This article shows how to render images from data stored in the database to a JSF view.

This solution was created for the following environment, but will work in other configurations.

JavaServer Faces (JSF) 1.2
Richfaces 3.2.2.GA
SpringFramework 2.5.5
Spring Webflow 2.0.3
Hibernate 3.2.6.ga

Instead of storing the image data in the database one could store the images to an external directory. I have used external image directories in several projects but I find scalability and image management is more difficult. This post will describe how to perform image management using the database to store the images.

UserImage - BaseDAOHibernateJPA - ImageManager
First it is necessary implement the code to retrieve the data from the database. In our case we were using JPA with Hibernate so I will identify the UserImage entity class along with the DAO and ImageManager classes to achieve this functionality.

@Entity

@Table(name = "user_image")
public class UserImage extends BaseObject {
private static final long serialVersionUID = 1410602442670943241L;
@Id
@GeneratedValue(strategy = GenerationType.AUTO)
@Column(name = "id")
private Long id;
@Version
private int version;
@Enumerated(EnumType.STRING)
@Column(name="image_type", nullable=false)
private ImageTypeEnum imageType = ImageTypeEnum.USER;
@ManyToOne(fetch=FetchType.LAZY)
@JoinColumn(name="user", nullable=false)
private User user;
@Column(name="filename")
private String filename;
@Column(name="filesize")
private long filesize;
@Column(name="data", columnDefinition="mediumBlob")
private byte[] data;
@Column(name="content_type")
private String contentType;
@Column(name="created_on", updatable=false, insertable=true)
private Date createdOn;
public UserImage() {
}
// Setters and Getters have been removed
}

The UserImage.data field has been mapped to a mediumBlob which is fine for MySQL. For Oracle this would have to be changed to Blob. I have also added a ImageType so that this table can be used to store different types of image data.

The following code segment displays the DAO base class which for our purposes is used to retrieve the UserImage data from the database through its CRUD operation getObject.

/**

* This class serves as the Base class DAO JPA support.
* Can be used for standard CRUD operations.
*
* @author Michael Root
* @since August 31, 2008
*/
@Repository("baseDAO")
public class BaseDAOHibernateJPA implements DAO {
protected final transient Log log = LogFactory.getLog(getClass());
@PersistenceContext
protected EntityManager entityManager;
/**
* @see com.serensys.golf.dao.DAO#saveObject( entity)
*/
public T saveObject(T entity) throws DataAccessException {
return entityManager.merge(entity);
}
/**
* @see com.serensys.golf.dao.DAO#getObject(Class, Object)
*/
public T getObject(Class entityClass, Object primaryKey) throws DataAccessException {
T entity = entityManager.find(entityClass, primaryKey);
if (entity == null) {
throw new DataRetrievalFailureException("Entity could not be found by key=" + primaryKey);
}
return entity;
}
/**
* @see com.serensys.golf.dao.DAO#removeObject(Object)
*/
public void removeObject(Object entity) throws DataAccessException {
entityManager.remove(entity);
}
/**
* @return the entityManager
*/
public EntityManager getEntityManager() {
return entityManager;
}
/**
* @param entityManager the entityManager to set
*/
public void setEntityManager(EntityManager entityManager) {
this.entityManager = entityManager;
}
}

The following class is the ImageManager that is called from the ImageDBServlet to retrieve the actual UserImage entity.

/**

* Implementation of UserImage interface.
*
* @author Michael Root
* @since October 31, 2008
*/
@Service("imageManager")
public class ImageManagerImpl extends BaseManager implements ImageManager {
/**
* @see com.serensys.golf.service.ImageManager#getUserImage(Long)
*/
@Transactional(readOnly = true)
public UserImage getUserImage(Long id) {
return this.baseDAO.getObject(UserImage.class, id);
}
}

ImageDBServlet
The following servlet renders the image data to the output stream as shown in the class below.

/**

* Special image servlet for efficiently resolving and rendering image resources from a database.
*
* @author Michael Root
*/
public class ImageDBServlet extends HttpServletBean {
private static final long serialVersionUID = -8604559719271081403L;
private static final String HTTP_CONTENT_LENGTH_HEADER = "Content-Length";
private static final String HTTP_LAST_MODIFIED_HEADER = "Last-Modified";
private static final String HTTP_EXPIRES_HEADER = "Expires";
private static final String HTTP_CACHE_CONTROL_HEADER = "Cache-Control";
private boolean gzipEnabled = true;
private static ApplicationContext appContext = null;
private ImageManager imageManager;
private Set compressedMimeTypes = new HashSet();
{
compressedMimeTypes.add("text/css");
compressedMimeTypes.add("text/javascript");
}
/**
* Method called by base class to allow subclass to initialize. The applicationContext
* imageManager will be retrieved from the applicationContext.
*/
protected void initServletBean() throws ServletException {
appContext = WebApplicationContextUtils.getWebApplicationContext(super.getServletContext());
if (appContext != null) {
imageManager = (ImageManager)appContext.getBean("imageManager");
}
}
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
String rawResourcePath = request.getPathInfo();
Long imageId = null;
if (logger.isDebugEnabled()) {
logger.debug("Attempting to GET resource: " + rawResourcePath);
}
// Get the index from the rawResourcePath
int idx = rawResourcePath.lastIndexOf("_");
// If index > 0 then parse imageId
if (idx > -1) {
String imageIdStr = rawResourcePath.substring(idx+1);
if (logger.isDebugEnabled()) {
logger.debug("doGet: imageIdStr: " + imageIdStr);
}
imageId = Long.parseLong(imageIdStr);
if (logger.isDebugEnabled()) {
logger.debug("doGet: imageId: " + imageId);
}
}
if (imageId == null || imageId.longValue() == 0) {
if (logger.isDebugEnabled()) {
logger.debug("Resource not found: " + rawResourcePath);
}
response.sendError(HttpServletResponse.SC_NOT_FOUND);
return;
}
try {
UserImage userImage = imageManager.getUserImage(imageId);
prepareResponse(response, userImage);
OutputStream out = selectOutputStream(request, response);
try {
InputStream in = new ByteArrayInputStream(userImage.getData());
try {
byte[] buffer = new byte[1024];
while (in.available() > 0) {
int len = in.read(buffer);
out.write(buffer, 0, len);
}
} finally {
in.close();
}
} finally {
out.close();
}
} finally {
}
}
private OutputStream selectOutputStream(HttpServletRequest request, HttpServletResponse response)
throws IOException {
String acceptEncoding = request.getHeader("Accept-Encoding");
String mimeType = response.getContentType();
if (gzipEnabled && StringUtils.hasText(acceptEncoding) && acceptEncoding.indexOf("gzip") > -1
&& compressedMimeTypes.contains(mimeType)) {
logger.debug("Enabling GZIP compression for the current response.");
return new GZIPResponseStream(response);
} else {
return response.getOutputStream();
}
}
private void prepareResponse(HttpServletResponse response, UserImage userImage)
throws IOException {
long lastModified = -1;
response.setContentType(userImage.getContentType());
response.setHeader(HTTP_CONTENT_LENGTH_HEADER, Long.toString(userImage.getFilesize()));
response.setDateHeader(HTTP_LAST_MODIFIED_HEADER, lastModified);
configureCaching(response, 31556926);
}
/**
* Set HTTP headers to allow caching for the given number of seconds.
* @param seconds number of seconds into the future that the response should be cacheable for
*/
private void configureCaching(HttpServletResponse response, int seconds) {
// HTTP 1.0 header
response.setDateHeader(HTTP_EXPIRES_HEADER, System.currentTimeMillis() + seconds * 1000L);
// HTTP 1.1 header
response.setHeader(HTTP_CACHE_CONTROL_HEADER, "max-age=" + seconds);
}
private class GZIPResponseStream extends ServletOutputStream {
private ByteArrayOutputStream byteStream = null;
private GZIPOutputStream gzipStream = null;
private boolean closed = false;
private HttpServletResponse response = null;
private ServletOutputStream servletStream = null;
public GZIPResponseStream(HttpServletResponse response) throws IOException {
super();
closed = false;
this.response = response;
this.servletStream = response.getOutputStream();
byteStream = new ByteArrayOutputStream();
gzipStream = new GZIPOutputStream(byteStream);
}
public void close() throws IOException {
if (closed) {
throw new IOException("This output stream has already been closed");
}
gzipStream.finish();
byte[] bytes = byteStream.toByteArray();
response.setContentLength(bytes.length);
response.addHeader("Content-Encoding", "gzip");
servletStream.write(bytes);
servletStream.flush();
servletStream.close();
closed = true;
}
public void flush() throws IOException {
if (closed) {
throw new IOException("Cannot flush a closed output stream");
}
gzipStream.flush();
}
public void write(int b) throws IOException {
if (closed) {
throw new IOException("Cannot write to a closed output stream");
}
gzipStream.write((byte) b);
}
public void write(byte b[]) throws IOException {
write(b, 0, b.length);
}
public void write(byte b[], int off, int len) throws IOException {
if (closed) {
throw new IOException("Cannot write to a closed output stream");
}
gzipStream.write(b, off, len);
}
public boolean closed() {
return (this.closed);
}
public void reset() {
// noop
}
}
public void setGzipEnabled(boolean gzipEnabled) {
this.gzipEnabled = gzipEnabled;
}
}

This code has implemented compression on the rendered image. More importantly I have implemented caching which will be discussed when we talk about the usage.

Configuration
In order to get the ImageServlet to work, add the following entries to the Web Deployment Descriptor web.xml:

ImageDB Servlet

com.serensys.golf.webapp.servlets.ImageDBServlet
0
ImageDB Servlet
/imagedb/*

Usage
The following code fragment shows the usage to display an image from the database

I am using the graphicImage from the JSF html library. The user.version and user.userImageId are added to the url of the userImage. The image is cached based on this name (e.g. userImage_1_23). If the userImage data does not change the image will be pulled from the cache. If the userImage data is changed the user.version property will be incremented and the userImage will be re-rendered with a new user.version. I hope this article helps in creating a solution to render images from the database.

Developing a Lightweight DND Portal

mroot — Thu, 14 Feb 2008 07:07:05 +0000

Many web sites have this drag-n-drop portal management feature like the home page for iGoogle. Google created their Google Gadgets that are simple HTML and JavaScript mini-applications served in iFrames that can be embedded in webpages and other apps.

Although there are several technologies available that one could use to develop this functionality within their web application, this article will focus on requirements, technology alternatives and in latter posts I will develop this technology with our chose technology alternative.

Requirements:

Drag - and - Drop AJAX functionality which allows customization for logged on users.
There will be a fixed number of components that can be displayed.
Each component has its own display and controller for handling requests. All components are developed to a standard interface.
Each component has a wrapper that contains a title bar and menu.

Technology Alternatives:

JSR 168 / 268 Solution
Utilize YUI Drag & Drop Component
Utilize Google Web Toolkit (GWT) with DND extensions by Allen Sauer

The JSR 168 defines a Java Portlet Specification that defines a contract between the portlet container and portlets and provides a convenient programming model for portlet developers. There are many commercial and open source portal servers:

Commercial Portal Servers:

IBM WEbSphere
Sun Java System Portal Server
BEA Weblogic
Oracle iAS
Liferay
Vignette
SAP
TIBCO
uPortal
OpenPortal

Open Source Portal Servers:

JBoss Enterprise Portal Platform
Apache Pluto
JetSpeed Portal
eXo Platform Portal

The JSR 168 standard is an overkill to our solution and require s a full blown portal server which is not what we are looking for.

YUI has some amazing components and I use these on several web sites. They have a Drag & Drop component that could be used but from my experience this control would only give me a partial solution which then would require modification of the YUI javascript. I don’t mind tweaking 3rd party components but this would require major modification to achieve our requirements.

From my initial research I believe the only alternative would be to develop a component using GWT. Future articles will describe the development of this component that we will call PortLight.

Maven 2 Life Cycle

mroot — Wed, 13 Dec 2006 06:30:12 +0000

This post contains information helpful in using maven 2.0. Maven is a software project management and comprehension tool. Based on the concept of a project object model (POM), Maven can manage a project’s build, reporting and documentation from a central piece of information.

Maven’s Default Build Life Cycle

validate	Validate the project is correct and all necessary information is available.
initialize	Initialize the build process.
generate-sources	Generate any source code for inclusion in compilation.
process-sources	Process the source code, for example to filter any values.
generate-resources	Generate resources for inclusion in the package.
process-resources	Copy and process the resources into the destination directory, ready for packaging.
compile	Compile the source code of the project.
process-classes	Post-process the generated files from compilation, for example to do byte code enhancement on Java classes.
generate-test-sources	Create resources for testing.
process-test-sources	Process the test source code, for example to filter any values.
generate-test-resources	Create resources for testing.
process-test-resources	Copy and process the resources into the test destination directory.
test-compile	Compile the test source code into the test destination directory test Run tests using a suitable unit testing framework. These tests should not require the code be packaged or deployed.
test	Run tests using a suitable unit testing framework. These tests should not require the code be packaged or deployed.
package	Take the compiled code and package it in its distributable format, such as a JAR.
pre-integration-test	Perform actions required before integration tests are executed. This may involve things such as setting up the required environment.
integration-test	Process and deploy the package if necessary into an environment where integration tests can be run.
post-integration-test	Perform actions required after integration tests have been executed. This may including cleaning up the environment.
verify	Run any checks to verify the package is valid and meets quality criteria.
install	Install the package into the local repository, for use as a dependency in other projects locally.
deploy	Done in an integration or release environment, copies the final package to the remote repository for sharing with other developers and projects.

AOP Definitions

mroot — Sun, 08 Oct 2006 06:24:02 +0000

Aspect-Oriented Programming (AOP) complements OOP by providing another way of thinking about program structure. While OO decomposes applications into a hierarchy of objects, AOP decomposes programs into aspects or concerns. This enables modularization of concerns such as transaction management that would otherwise cut across multiple objects. (Such concerns are often termed crosscutting concerns.)

AOP Concepts

There are two distinct types of AOP:

static: crosscutting logic is applied to your code at compile time, and you cannot change it without modifying the code and recompiling. Aspectj provides this type of implementation.
dynamic: With dynamic AOP, like spring AOP, crosscutting logic is applied dynamically, at runtime.

These types of AOP are complementary and, when used together, they form a powerful combination that you can use in your applications.In defining the copcepts of AOP the definitions that I use will be SpringFramwork centric.

Aspect: A modularization of a concern for which the implementation might otherwise cut across multiple objects. Transaction management is a good example of a crosscutting concern in J2EE applications. Aspects are implemented using Spring as Advisors or interceptors.
Joinpoint: Point during the execution of a program, such as a method invocation or a particular exception being thrown. In Spring AOP, a joinpoint is always method invocation. Spring does not use the term joinpoint prominently; joinpoint information is accessible through methods on the MethodInvocation argument passed to interceptors, and is evaluated by implementations of the org.springframework.aop.Pointcut interface.
Advice: Action taken by the AOP framework at a particular joinpoint. Different types of advice include “around,” “before” and “throws” advice. Advice types are discussed below. Many AOP frameworks, including Spring, model an advice as an interceptor, maintaining a chain of interceptors “around” the joinpoint.
Pointcuts: Are predicates determining which joinpoints a piece of advice should apply to. It’s more intuitive — although not entirely accurate — to think of a pointcut as a set of jointponts. Pointcuts identify where advice should apply. Thye majic of AOP lies more in the specification of where action should be taken (pointcut) than what action to apply (advice).

Spring Advice Types

Around Advice: Advice that surrounds a joinpoint such as a method invocation. This is the most powerful kind of advice. Around advices will perform custom behavior before and after the method invocation. They are responsible for choosing whether to proceed to the joinpoint or to shortcut executing by returning their own return value or throwing an exception.
Before Advice: Advice that executes before a joinpoint, but which does not have the ability to prevent execution flow proceeding to the joinpoint (unless it throws an exception).
After Returning Advice: is invoked when a method returns successfully, without throwing an exception. As with before advice, the return type is void; after returning advices are not intended to change the return value.
Throws Advice: Advice to be executed if a method throws an exception. Spring provides strongly typed throws advice, so you can write code that catches the exception (and subclasses) you’re interested in, without needing to cast from Throwable or Exception.

DarwinPorts to Install Apache2 and PHP5

mroot — Sun, 09 Jul 2006 06:19:26 +0000

This post discusses the installation of Apache 2.2.2and PHP 5.1.4 on Mac OS X 10.4.7. Initially I tried to build the open source applications and install but after a few attempts I decided to use DarwinPorts to automatically build and install these two applications.This weekend I decided to upgrade my apache and php versions on my MacBook to the latest version. I searched the web for any existing articles regarding this upgrade and came across the following article:

Building and Installing Apache 2.2.2 and PHP 5.1.4 on Mac OS X 10.4.6

I had no problem building and installing Apache 2.2.2, at least after I installed XTools from the OS X development disk. During the make of PHP there was an issue with dependency. After doing more research others having the same problem had to buid php with mySQL 4.x instead of 5.x. I decided to utilize DarwinPorts to build and install the open source software.

I downloaded and installed DarwinPorts-1.2.1. After DarwinPorts was install I peformed the following steps to install apache2:

Build and install Apache2.
```
sudo port install apache2
```

Create a default conf file for apache.

cd /opt/local/apache2/conf
sudo cp httpd.conf.sample httpd.conf

Start apache2 on startup.

sudo launchctl load -w /Library/LaunchDaemons/org.darwinports.apache2.plist

When apache2 is installed the default DocumentRoot is /opt/local/apache2/htdocs/. I modified the DocumentRoot to point back to the default OS X location of /Library/WebServer/Documents/.

I would refer to the apache2 documentation to configure the httpd.conf according to your requirements.

To start apache2 execute the followng command:

sudo /opt/local/apache2/bin/apachectl -k start

The following steps were followed to install php5.

Install wget which is required by php5.
```
sudo port install wget
```
Build and install php5.
```
sudo port install php5 +apache2 +mysql4
```

cd /opt/local/apache2/modules
/opt/local/apache2/bin/apxs -a -e -n "php5" libphp5.so

Create php.ini file

cp /opt/local/etc/php.ini-dist to  /opt/local/etc/php.ini

One other article was useful in installing apache2 using DarwinPorts: DarwinPorts:MAMP
I hope this post helps in setting up apache2 and php5.

JAXB

mroot — Wed, 07 Jun 2006 06:14:38 +0000

The JavaTM Architecture for XML Binding (JAXB) provides an API and tools that automate the mapping between XML documents and Java objects.

The JAXB framework enables developers to perform the following operations:

Unmarshal XML content into a Java representation
Access and update the Java representation
Marshal the Java representation of the XML content into XML content

JAXB gives Java developers an efficient and standard way of mapping between XML and Java code. Java developers using JAXB are more productive because they can write less code themselves and do not have to be experts in XML. JAXB makes it easier for developers to extend their applications with XML and Web Services technologies.

Extending Acegi Security

mroot — Mon, 10 Apr 2006 05:25:10 +0000

This article shows how to add several security enhancements to a web application that is utilizing Acegi Security. These security enhancements include:

How to add funcitonality to force the user to change thier password on thier first login
After a selected number of failed login attempts the system will temporarily lock the user account for a pre-determined amount of time
Not allow the user to re-use a pe-selected number of previous passwords that are stored in a password history.

Acegi Security Fundamentals

Acegi Security provides comprehensive security services for J2EE-based enterprise software applications. There is a particular emphasis on supporting projects built using The Spring Framework, which is the leading J2EE solution for enterprise software development. If you’re not using Spring for developing enterprise applications, we warmly encourage you to take a closer look at it. Some familiarity with Spring - and in particular dependency injection principles - will help you get up to speed with Acegi Security more easily.

To help understand this article I will explain some of Acegi security fundamentals.

SecurityContextHolder - This is where the details of the present security context of the application is stored, which includes details of the principal currently using the application. By default the SecurityContextHolder uses a ThreadLocal to store these details, which means that the security context is always available to methods in the same thread of execution, even if the security context is not explicitly passed around as an argument those methods.

Inside the SecurityContextHolder we store details of the principal currently interacting with the application. Acegi Security uses an Authentication object to represent this information. You won’t normally need to create an Authentication object yourself, it is fairly common for users to query the Authentication object.
You can use the following code block - from anywhere in your application - to do this:

Object obj = SecurityContextHolder.getContext().getAuthentication().getPrincipal();

if (obj instanceof UserDetails) {

   String username = ((UserDetails)obj).getUsername();

} else {

   String username = obj.toString();

}

As the above code indicates the principal can be a username (String) or an object then implements the UserDeails interface. In our application we use the latter approach.

SecurityContext - Holds the Authentication and possibly request-specific security information.
HttpSessionContextIntegrationFilter - Stores the SecurityContext in the HttpSession between web requests.
Authentication - Represents the principal in an Acegi Security-specific manner.
GrantedAuthority - Reflects the application-wide permissions granted to a principal.
UserDetails - to provide the necessary information to build an Authentication object from your application’s DAOs.
UserDetailsService - Creates a UserDetails when passed in a String-based username (or certificate ID or alike).
Filters - Acegi Security uses many filters. You have a choice in how these filters are added to your web application, in that you can use either FilterToBeanProxy or FilterChainProxy. In my example application I use FilterChainProxy, which is configured through the web.xml as:

    
        securityFilter
        org.acegisecurity.util.FilterToBeanProxy
        
            targetClass
            org.acegisecurity.util.FilterChainProxy

Notice that the filter in web.xml is actually a FilterToBeanProxy, and not the filter that will actually implement the logic of the filter. What FilterToBeanProxy does is delegate the Filter’s methods through to a bean which is obtained from the Spring application context. This enables the bean to benefit from the Spring application context lifecycle support and configuration flexibility. The bean must implement javax.servlet.Filter. The FilterToBeanProxy only requires a single initialization parameter, targetClass or targetBean. The targetClass parameter locates the first object in the application context of the specified class, whilst targetBean locates the object by bean name. Like standard Spring web applications, the FilterToBeanProxy accesses the application context via WebApplicationContextUtils.getWebApplicationContext(ServletContext), so you should configure a ContextLoaderListener in web.xml.In our sample application the FilterChainProxy is defined as follows:

    
        
            
                CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
                PATTERN_TYPE_APACHE_ANT
                /remoting/**=httpSessionContextIntegrationFilterWithASCFalse,
			basicProcessingFilter,exceptionTranslationFilter,filterInvocationInterceptor
		/**=httpSessionContextIntegrationFilter,authenticationProcessingFilter,
			remoteUserFilter,anonymousProcessingFilter,concurrentSessionFilter,
			exceptionTranslationFilter,passwordChangeFilter,vendorSetupFilter,
			filterInvocationInterceptor

The above declarations will cause every web request to be passed through to Acegi Security’s FilterChainProxy. As explained in the filters section of the Acegi reference guide, the FilterChainProxy is a generally-useful class that enables web requests to be passed to different filters based on the URL patterns. Those delegated filters are managed inside the application context, so they can benefit from dependency injection.We are now ready to discuss the the security enhancements listed in the introduction.

Force the user to change password on first login

This requirement ensures that the user changes the password after the account is created. But this functionality can be expanded to force the user to change their password at specified intervals.

DaoAuthenticationProvider returns an Authentication object which in turn has its principal property set. The principal will be either a String (which is essentially the username) or a UserDetails object (which was looked up from the UserDetailsService). By default the UserDetails is returned, as this enables applications to add extra properties potentially of use in applications, such as the user’s full name, email address etc. If using container adapters, or if your applications were written to operate with Strings (as was the case for releases prior to Acegi Security 0.6), you should set the DaoAuthenticationProvider.forcePrincipalAsString
property to true in your application context.

In our sample application we are returning a user object that implements the UserDetails interface. We added the boolean property passwordChangeRequired to the user object to indicate if a password change is required.

The next step will be to add a filter that will direct the user to the change password page. This will be handled by adding a changePasswordFilter that intercepts all requests. This filter will redirect the request to the changePassword jsp page if the passwordChangeRequired flag is set on the user object.

The diagram below displays a simple login flow:

The passwordChangeFilter will have to be robust enough to avoid recursion and avoid redirect if the logout page is being displayed.

The setting of the User.passwordChangeRequired property can be defaulted to true so that all users added to the system will be required to have their password changed. This works great if an admin is adding users to the system but may not be desired if the users are registering themselves. Clearng of the User.passwordChangeRequired property is handled thorugh the changePasswordController which is a standard Model-View-Controller (MVC) that handles setting the user password and clearing this User.passwordChangeRequired property.

Temporarily lock user account after failed login attempts

This requirement is usefull at discouraging attempts at hacking the user password using automatted bots. If the user account is lociked for 30 minutes after three invalid login attempts this would presumably stop any attempt at trying to automatically guess the password, it would take to long.