I'm currently designing a secure online system and had an idea for a defense of sorts,
I would like to send a URL header holding a few javascript lines:
Code:
javascript: var a = 0; do {alert("Access Denied");} while (a == 0);
as a sort of slap for attempting access to the system. The system currently locks accounts if multiple failed attempts occur, this won't be a single line of defense, but is this legal?