Problem Statement
Why is rate limiting essential for public APIs and how should it be applied?
Explanation
APIs are easy to automate. Attackers exploit this for brute force, scraping, and credential stuffing. Rate limits slow abuse and protect upstream services. Apply limits per user, per IP, and per token. Include burst and sustained windows. Return clear errors and backoff hints. Combine with detection for anomalous patterns and block lists. Tie limits to critical operations, like login or password reset, for stronger protection.
Code Solution
SolutionRead Only
POST /login 5 req per min per account; 100 req per min per IP; exponential backoff on 429
