You can't easily use a timer in a web application like this; you should instead implement a solution where you, at the time you decide to lock the user out for one hour, update a database column that locks the user out until one hour after the current time. Here is pseudo code:
bool Login(string username, string password){
User x = DoDbLookupForUser(username)
//user table has USERNAME, HASHEDPASSWORD, WRONGATTEMPTSCOUNTER, LOCKEDOUTUNTILDATE columns
if x == null
throw new UserNotFoundException
if DateTime.Now < x.LockedOutUntilDate
throw new UserLockedOutException
if x.HashedPassword != Hash(password){
x.WrongAttemptsCounter++
if x.WrongAttemptsCounter >= 3
x.LockedOutUntilDate = DateTime.Now.AddHours(1)
SaveUser(x)
throw new UserPasswordIncorrectException
}
x.WrongAttemptsCounter = 0;
SaveUser(x)
return true
}
After 3 attempts the user is locked out. They can try again after one hour. If they get it wrong again they are locked out for another hour. If you want to give them 3 attempts in an hour reset the counter to 0 when you set the date rather than on successful login. There is no need to reset the lockout date to null; as soon as it goes into the past it will be ignored. It can be handy to know if a user has ever locked themselves out and when so might as well keep the data