@Override
    public boolean exceedsThreshold(final HttpServletRequest request) {
        val clientInfo = ClientInfoHolder.getClientInfo();
        val remoteAddress = clientInfo.getClientIpAddress();

        val throttle = getConfigurationContext().getCasProperties().getAuthn().getThrottle();
        val query = new Query()
            .addCriteria(Criteria.where("clientIpAddress").is(remoteAddress)
                .and("principal").is(getUsernameParameterFromRequest(request))
                .and("actionPerformed").is(throttle.getFailure().getCode())
                .and("applicationCode").is(throttle.getCore().getAppCode())
                .and("whenActionWasPerformed").gte(getFailureInRangeCutOffDate()));
        query.with(Sort.by(Sort.Direction.DESC, "whenActionWasPerformed"));
        query.limit(2);
        query.fields().include("whenActionWasPerformed");

        LOGGER.debug("Executing MongoDb throttling query [{}]", query);
        val failures = this.mongoTemplate.find(query, AuditActionContext.class, this.collectionName)
            .stream()
            .map(this::toThrottledSubmission)
            .collect(Collectors.toList());
        return calculateFailureThresholdRateAndCompare(failures);
    }
Works in conjunction with a Mongo database to block attempts to dictionary attack users.

@author Misagh Moayyed
@since 5.3.0
support/cas-server-support-throttle-mongo/src/main/java/org/apereo/cas/web/support/MongoDbThrottledSubmissionHandlerInterceptorAdapter.java