Rate limiting restricts how often an actor can access a protected resource. On login pages, it slows brute-force attacks by delaying responses after incorrect password guesses, while usually leaving occasional human mistypes almost unaffected. section 8.8
Apply rate limiting with these practical trade-offs in mind:
- Use progressive delays, such as exponential backoff that doubles the delay after each failure, to bog down rapid attacks. section 8.8
- Avoid relying only on usernames: attackers can repeatedly target one account to create a lockout attack and deny service to its owner. section 8.8
- Consider applying penalties by IP address, while accounting for shared proxies, VPNs, corporate networks, TOR, and distributed bot attacks. section 8.8
- Use rate limits alongside CAPTCHA protection for login, sign-up, and password-reset pages rather than treating one control as sufficient. section 8.17
Login response delays
A login endpoint can return almost immediately after the first incorrect password, then impose progressively longer delays after repeated failures. A brute-force tool soon becomes too slow to continue, while a legitimate user who mistypes once experiences little disruption. section 8.8
