core-bundle/src/Security/Authentication/Provider/AuthenticationProvider.php
public function onBadCredentials(User $user, AuthenticationException $exception): AuthenticationException
    {
        --$user->loginCount;

        if ($user->loginCount > 0) {
            $user->save();

            return new BadCredentialsException(
                sprintf('Invalid password submitted for username "%s"', $user->username),
                $exception->getCode(),
                $exception
            );
        }

        $user->locked = time() + $this->options['lock_period'];
        $user->loginCount = $this->options['login_attempts'];
        $user->save();

        $lockedSeconds = $user->locked - time();
        $lockedMinutes = (int) ceil($lockedSeconds / 60);

        $exception = new LockedException(
            $lockedSeconds,
            sprintf('User "%s" has been locked for %s minutes', $user->username, $lockedMinutes),
            0,
            $exception
        );

        $exception->setUser($user);

        return $exception;
    }
public function onBadCredentials(User $user, AuthenticationException $exception): AuthenticationException
    {
        --$user->loginCount;

        if ($user->loginCount > 0) {
            $user->save();

            return new BadCredentialsException(
                sprintf('Invalid password submitted for username "%s"', $user->username),
                $exception->getCode(),
                $exception
            );
        }

        $user->locked = time() + $this->options['lock_period'];
        $user->loginCount = $this->options['login_attempts'];
        $user->save();

        $lockedSeconds = $user->locked - time();
        $lockedMinutes = (int) ceil($lockedSeconds / 60);

        $exception = new LockedException(
            $lockedSeconds,
            sprintf('User "%s" has been locked for %s minutes', $user->username, $lockedMinutes),
            0,
            $exception
        );

        $exception->setUser($user);

        return $exception;
    }
Counts the login attempts and locks the user if it reaches zero.