This method is called after validating user name and password. If user name and password were correct, the sleep time is reset, otherwise this method waits some time (to make brute force / rainbow table attacks harder) and then throws a 'wrong user or password' exception. The delay is a bit randomized to protect against timing attacks. Also the delay doubles after each unsuccessful logins, to make brute force attacks harder. There is only one exception message both for wrong user and for wrong password, to make it harder to get the list of user names. This method must only be called from one place, so it is not possible from the stack trace to see if the user name was wrong or the password.

Parameters

correct:boolean

if the user name or the password was correct

Exceptions

DbException:

the exception 'wrong user or password'