Device cookie is another security layer that allows fine grain of blocking potentially brute force authentication requests. Example algorithm :   (above diagrams taken from recompiled.pl) example article: https://recompiled.pl/device-cookie/