Rate Limiting (Rate Limiting)
Why Rate Limiting Matters
Without rate limiting, attackers can make unlimited requests to your login endpoint (brute forcing passwords), API (consuming expensive resources or extracting data), or any endpoint (denial of service). Rate limiting makes these attacks impractical by limiting the attacker's throughput.
Effective rate limiting requires choosing the right identifier (IP address, API key, user account), the right limits (strict enough to stop attacks but permissive enough for legitimate use), and the right response (429 Too Many Requests with Retry-After header).
Common rate limiting strategies include: per-IP limits for login endpoints (e.g., 5 attempts per minute), per-API-key limits for API usage (e.g., 100 requests per minute), and progressive penalties (increasing delay after each failed attempt). For login endpoints, account lockout after N failed attempts adds another layer.
How to Check
A security audit evaluates rate limiting by checking response headers (X-RateLimit-Limit, X-RateLimit-Remaining, Retry-After). For login endpoints, test whether rapid repeated requests are throttled. Cloud providers like Cloudflare offer built-in rate limiting.