diff --git a/core/Controller/LoginController.php b/core/Controller/LoginController.php
index 1c75b1f3c8be37e9d7a6e69ce2ddd22e2f5c1f23..12431571256c938a8b8dbf945e2c2fc71213ac4e 100644
--- a/core/Controller/LoginController.php
+++ b/core/Controller/LoginController.php
@@ -248,7 +248,7 @@ class LoginController extends Controller {
 				$args['redirect_url'] = $redirect_url;
 			}
 			$response = new RedirectResponse($this->urlGenerator->linkToRoute('core.login.showLoginForm', $args));
-			$response->throttle();
+			$response->throttle(['user' => $user]);
 			$this->session->set('loginMessages', [
 				['invalidpassword'], []
 			]);
diff --git a/lib/private/AppFramework/Middleware/Security/BruteForceMiddleware.php b/lib/private/AppFramework/Middleware/Security/BruteForceMiddleware.php
index 78c86442b52ead962c3b62aceb4499d10871b700..b7ec137062fb58dfd78bd8cba03d4ab87b6002dd 100644
--- a/lib/private/AppFramework/Middleware/Security/BruteForceMiddleware.php
+++ b/lib/private/AppFramework/Middleware/Security/BruteForceMiddleware.php
@@ -76,7 +76,7 @@ class BruteForceMiddleware extends Middleware {
 			$action = $this->reflector->getAnnotationParameter('BruteForceProtection', 'action');
 			$ip = $this->request->getRemoteAddress();
 			$this->throttler->sleepDelay($ip, $action);
-			$this->throttler->registerAttempt($action, $ip);
+			$this->throttler->registerAttempt($action, $ip, $response->getThrottleMetadata());
 		}
 
 		return parent::afterController($controller, $methodName, $response);
diff --git a/lib/public/AppFramework/Http/Response.php b/lib/public/AppFramework/Http/Response.php
index c3b81d2baf77c60e201c7c547c62ad652e2825f7..94f09a5573778f44f8691809d23d643e5ce262c4 100644
--- a/lib/public/AppFramework/Http/Response.php
+++ b/lib/public/AppFramework/Http/Response.php
@@ -83,6 +83,8 @@ class Response {
 
 	/** @var bool */
 	private $throttled = false;
+	/** @var array */
+	private $throttleMetadata = [];
 
 	/**
 	 * Caches the response
@@ -328,10 +330,22 @@ class Response {
 	 * Marks the response as to throttle. Will be throttled when the
 	 * @BruteForceProtection annotation is added.
 	 *
+	 * @param array $metadata
 	 * @since 12.0.0
 	 */
-	public function throttle() {
+	public function throttle(array $metadata = []) {
 		$this->throttled = true;
+		$this->throttleMetadata = $metadata;
+	}
+
+	/**
+	 * Returns the throttle metadata, defaults to empty array
+	 *
+	 * @return array
+	 * @since 13.0.0
+	 */
+	public function getThrottleMetadata() {
+		return $this->throttleMetadata;
 	}
 
 	/**
diff --git a/tests/Core/Controller/LoginControllerTest.php b/tests/Core/Controller/LoginControllerTest.php
index bd2d0143caf30c8b341b97488738471f93bbcb3f..493bade9dd8c040e541d8aabc1a957ef05d911f7 100644
--- a/tests/Core/Controller/LoginControllerTest.php
+++ b/tests/Core/Controller/LoginControllerTest.php
@@ -307,7 +307,7 @@ class LoginControllerTest extends TestCase {
 			->method('deleteUserValue');
 
 		$expected = new \OCP\AppFramework\Http\RedirectResponse($loginPageUrl);
-		$expected->throttle();
+		$expected->throttle(['user' => 'MyUserName']);
 		$this->assertEquals($expected, $this->loginController->tryLogin($user, $password, '/apps/files'));
 	}
 
@@ -634,7 +634,7 @@ class LoginControllerTest extends TestCase {
 			->method('createRememberMeToken');
 
 		$expected = new RedirectResponse('');
-		$expected->throttle();
+		$expected->throttle(['user' => 'john']);
 		$this->assertEquals($expected, $this->loginController->tryLogin('john@doe.com', 'just wrong', null));
 	}
 }
diff --git a/tests/lib/AppFramework/Http/ResponseTest.php b/tests/lib/AppFramework/Http/ResponseTest.php
index d8959face89f6088b8a9d9a04a158d697fc21653..9267d862600edc55b05376b7387fabcba73e1ba1 100644
--- a/tests/lib/AppFramework/Http/ResponseTest.php
+++ b/tests/lib/AppFramework/Http/ResponseTest.php
@@ -269,4 +269,9 @@ class ResponseTest extends \Test\TestCase {
 		$this->childResponse->throttle();
 		$this->assertTrue($this->childResponse->isThrottled());
 	}
+
+	public function testGetThrottleMetadata() {
+		$this->childResponse->throttle(['foo' => 'bar']);
+		$this->assertSame(['foo' => 'bar'], $this->childResponse->getThrottleMetadata());
+	}
 }
diff --git a/tests/lib/AppFramework/Middleware/Security/BruteForceMiddlewareTest.php b/tests/lib/AppFramework/Middleware/Security/BruteForceMiddlewareTest.php
index 14d3b796846830dabbf5038bc2a57c3976b3a429..ae2345764ff566e87ddb930afd233574ee56b90d 100644
--- a/tests/lib/AppFramework/Middleware/Security/BruteForceMiddlewareTest.php
+++ b/tests/lib/AppFramework/Middleware/Security/BruteForceMiddlewareTest.php
@@ -112,6 +112,10 @@ class BruteForceMiddlewareTest extends TestCase {
 			->expects($this->once())
 			->method('isThrottled')
 			->willReturn(true);
+		$response
+			->expects($this->once())
+			->method('getThrottleMetadata')
+			->willReturn([]);
 		$this->reflector
 			->expects($this->once())
 			->method('getAnnotationParameter')