Rate limiting restricts how many requests a client or identity can make during a defined interval. It controls abuse, protects resources, and helps keep API behavior predictable. section 5.1.2 section 11.6
Without limits, repeated requests can support brute-force account takeover or scrape data from an endpoint. Effective controls combine thresholds with investigation, request-origin data, and targeted blocking. section 5.1.2 section 11.6
A practical rate-limiting design can:
- Count requests by account and originating IP, then lock an account or block an IP after a defined threshold. section 5.1.2
- Monitor endpoint requests per minute, investigate unusual spikes, and rate-limit the endpoint when the activity is confirmed as anomalous. section 11.6
- Use client IP, device fingerprint, user ID, or region to distinguish targeted abuse from traffic affecting all users. section 11.6
- Account for privacy obligations when tracking IP addresses, which may be personally identifiable information. section 5.1.2
Protecting a login endpoint
A login service can lock an account after 10 attempts within 24 hours and block an IP after 10 login requests in the same period. Middleware checks blocked IPs and locked accounts before continuing, increments both counters, and returns an error when a limit is reached. section 5.1.2
Listing 5.2 Preventing brute-force attacks
# file: ch05/unrestricted_resource_consumption.py
login_attempts_ips = defaultdict(int) #1
login_attempts_accounts = defaultdict(int)
blocked_ips = [] #2
locked_accounts = []
@server.middleware("http.request") #3
async def prevent_brute_force_login(request: Request, call_next):
if request.client.host in blocked_ips: #4
return JSONResponse(status_code=401, content={"error": "Blocked"})
if request.url.path != "/login": #5
return await call_next(request)
payload = await request.json() #6
if payload["email"] in locked_accounts: #7
return JSONResponse(status_code=401, content={"error": "Locked"})
login_attempts_ips[request.client.host] += 1 #8
login_attempts_accounts[payload["email"]] += 1
if login_attempts_ips[request.client.host] == 10: #9
blocked_ips.append(request.client.host)
if login_attempts_accounts[payload["email"]] == 10: #10
locked_accounts.append(payload["email"])
login_attempts_accounts[payload["email"]] = 0
return await call_next(request) #11
Inspect the middleware pattern for checking blocked clients, identifying the login endpoint, counting requests, and enforcing account and IP controls. section 5.1.2
