Beginner LevelAuthentication & Authorization
Why are Account Lockout and Login Endpoint Rate Limiting necessary?
❓ Interview Prompt: Explain brute-force attacks, credential stuffing, IP rate limiting, failed attempt counters, and exponential backoff.
Public authentication endpoints ('/login') are prime targets for automated attacks:
•
Brute-Force Attacks: Systematically guessing passwords for a specific username.
•
Credential Stuffing: Testing millions of leaked username/password pairs obtained from dark web breaches.
Defensive Controls:
1
IP Rate Limiting: Caps maximum login attempts per IP address (e.g. max 5 attempts per minute) using Redis sliding window algorithms.
2
Account Lockout: Temporarily locks an individual user account (or triggers CAPTCHA) after 5 consecutive failed attempts.
3
Exponential Backoff: Dynamically increases delay times between consecutive failed attempts ($1s, 2s, 4s, 8s...$).
Code Implementation Example
typescript
import rateLimit from 'express-rate-limit';
// Strict rate limiting specifically for authentication endpoints
const loginRateLimiter = rateLimit({
windowMs: 15 * 60 * 1000, // 15 Minute window
max: 5, // Limit each IP to 5 failed requests per window
message: { error: 'Too many login attempts. Please try again after 15 minutes.' },
standardHeaders: true,
legacyHeaders: false
});
app.post('/api/login', loginRateLimiter, handleLogin);💡Applying rate limiting middleware to login endpoint to prevent brute-force attacks.
🎯 Interview Key Takeaway
Protect login endpoints against brute-force and credential stuffing using IP rate limiting and account lockouts.
#Rate Limiting#Brute-Force#Security#Lockout#Beginner
Back to all Authentication & Authorization Questions→