Re: [keycloak-dev] Brute force attack protection

We could do the sleep on the client side. We'd set a flag on the account saying it's disabled until some time in the future. If an account is locked we can display a page that says wait N seconds (or something), and after N seconds redirect redirect to login form using meta refresh.