1 files changed, 4 insertions, 2 deletions
diff --git a/config/initializers/doorkeeper.rb b/config/initializers/doorkeeper.rb
index 88cd0f5f652..44b658e5872 100644
--- a/config/initializers/doorkeeper.rb
+++ b/config/initializers/doorkeeper.rb
@@ -12,8 +12,10 @@ Doorkeeper.configure do
   end
 
   resource_owner_from_credentials do |routes|
-    user = Gitlab::Auth.find_with_user_password(params[:username], params[:password])
-    user unless user.try(:two_factor_enabled?)
+    Gitlab::Auth::UniqueIpsLimiter.limit_user! do
+      user = Gitlab::Auth.find_with_user_password(params[:username], params[:password])
+      user unless user.try(:two_factor_enabled?)
+    end
   end
 
   # If you want to restrict access to the web interface for adding oauth authorized applications, you need to declare the block below.