Bruteforce security for 2FA

Hello everyone, while trying to set up fail2ban, I noticed that it is not possible to ban wrong 2FA attempts, since there is no IP in the Accesslog and I cannot write a regex for it: This is how my config looks like: This is a cut of the access log of me trying to log in with false 2FA (email in this case): [2025-01-27 10:49:03.224][tracing::span][TRACE] parse_headers; [2025-01-27 10:49:03.224][tracing::span::active][TRACE] -> parse_headers; [2025-01-27 10:49:03.224][tracing::span::active][TRACE] <- parse_headers; [2025-01-27 10:49:03.224][tracing::span][TRACE] -- parse_headers; [2025-01-27 10:49:03.225][request][INFO] POST /identity/connect/token [2025-01-27 10:49:03.225][rocket::form::parser::_][TRACE] url-encoded field: ("scope", "api%20offline_access") [2025-01-27 10:49:03.225][rocket::form::parser::_][TRACE] url-encoded field: ("client_id", "web") [2025-01-27 10:49:03.225][rocket::form::parser::_][TRACE] …