如何在Java webapp中限制登录尝试？

import java.util.concurrent.TimeUnit;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;

public class LoginAttemptsLimiter {

    private static final String LOGIN_ATTEMPTS_KEY = "login_attempts";
    private static final int MAX_LOGIN_ATTEMPTS = 3;
    private static final long LOGIN_ATTEMPTS_TIMEOUT = TimeUnit.MINUTES.toMillis(1);

    public static boolean isLoginAllowed(HttpServletRequest request) {
        HttpSession session = request.getSession(true);
        long currentTime = System.currentTimeMillis();
        @SuppressWarnings("unchecked")
        Map<Long, Integer> loginAttempts = (Map<Long, Integer>) session.getAttribute(LOGIN_ATTEMPTS_KEY);
        if (loginAttempts == null) {
            loginAttempts = new HashMap<>();
            session.setAttribute(LOGIN_ATTEMPTS_KEY, loginAttempts);
        }
        Iterator<Long> iterator = loginAttempts.keySet().iterator();
        while (iterator.hasNext()) {
            long timestamp = iterator.next();
            if (currentTime - timestamp > LOGIN_ATTEMPTS_TIMEOUT) {
                iterator.remove();
            }
        }
        int loginAttemptsCount = loginAttempts.getOrDefault(currentTime, 0);
        if (loginAttemptsCount >= MAX_LOGIN_ATTEMPTS) {
            return false;
        }
        loginAttempts.put(currentTime, loginAttemptsCount + 1);
        return true;
    }

}

if (!LoginAttemptsLimiter.isLoginAllowed(request)) {
    // 登录尝试次数过多，拒绝登录
    response.sendError(HttpServletResponse.SC_FORBIDDEN, "Too many login attempts. Please try again later.");
    return;
}

// 进行登录处理逻辑