I’m using Django Axes to lock out users after a certain number of failed login attempts. However, despite my configurations, users are still able to log in immediately after being locked out if they enter the correct credentials. I want to ensure that users are locked out for 1 hour, regardless of whether they enter the correct credentials during that period.

Here are my current settings in settings.py:

from datetime import timedelta

AXES_FAILURE_LIMIT = 3
AXES_LOCK_OUT_AT_FAILURE = True
AXES_COOLOFF_TIME = timedelta(hours=1)  # Set cool-off time to 1 hour
AXES_LOCKOUT_CALLABLE = "customer_manager.views.lockout"
AXES_RESET_ON_SUCCESS = False
AXES_ENABLE_ACCESS_FAILURE_LOG = True
AXES_RESET_COOL_OFF_ON_FAILURE_DURING_LOCKOUT = False
AXES_SENSITIVE_PARAMETERS = []
AXES_LOCKOUT_PARAMETERS = ["username"]
AXES_CACHE = 'default'

CACHES = {
    'default': {
        'BACKEND': 'django_redis.cache.RedisCache',
        'LOCATION': 'redis://127.0.0.1:6379/1',
        'OPTIONS': {
            'CLIENT_CLASS': 'django_redis.client.DefaultClient',
        }
    }
}

I have verified the following:

axes.middleware.AxesMiddleware is included in the MIDDLEWARE settings, placed after AuthenticationMiddleware.
I have run python manage.py migrate and confirmed there are no pending migrations.
I have temporarily removed the custom lockout callable to test with default settings.

Despite these configurations, users are still able to log in immediately after being locked out if they enter the correct credentials. Here are some relevant log entries:

AXES: User login failed, running database handler for failure.
AXES: Cleaned up 0 expired access attempts from database that were older than 2024-08-07 09:24:53.250394+00:00
Using parameter credentials to get username with key settings.AXES_USERNAME_FORM_FIELD
AXES: Repeated login failure by {username: "daniyal", ip_address: "127.0.0.1", user_agent: "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0", path_info: "/options/admin/login/"}. Updated existing record in the database.
Using parameter credentials to get username with key settings.AXES_USERNAME_FORM_FIELD
AXES: Getting access attempts that are newer than 2024-08-07 09:24:53.250394+00:00
AXES: Locking out {username: "daniyal", ip_address: "127.0.0.1", user_agent: "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0", path_info: "/options/admin/login/"} after repeated login failures.
rest_framework.exceptions.AuthenticationFailed: Invalid credentials, try again

What am I missing or doing wrong? Any help would be greatly appreciated!