Sign in Get started

Rate Limiting, Quotas & Abuse Protection · Capstone

Capstone: Stop a Credential-Stuffing Attack

Respond to an active attack and harden login permanently.

Scenario

At 02:00 login traffic jumped 40×: 2 million attempts across 900,000 accounts from 60,000 residential IPs, with a 0.8% success rate. Per-IP limits (100/min) barely triggered. Several accounts were taken over and gift cards purchased.

Requirements

  • Immediate mitigation
  • Protect compromised users
  • Long-term hardening

Constraints

  • Legitimate users must still be able to log in
  • Mobile app can't show web CAPTCHAs without an update

Deliverables

  1. Immediate actions (first hour).
  2. Protect affected users and harden long term.

Draft each deliverable below before revealing the model answer and rubric.

Further reading: OWASP Credential Stuffing Prevention Cheat Sheet

Deliverables

Immediate actions (first hour).

Model answer

Enable edge bot management / managed challenge on login for suspicious scores; global login failure-rate circuit (when failure ratio > X, require challenge/step-up for all risky logins); temporarily require email OTP for logins from new devices; block offending ASNs/fingerprints where clearly malicious; freeze gift card purchases from new-device sessions.

Rubric

Look for global, behavior-based controls since per-IP limits failed.

Protect affected users and harden long term.

Model answer

Force password reset + revoke sessions for accounts with successful suspicious logins; notify users; reverse fraudulent purchases. Long term: breached-password checks, MFA/passkeys encouraged or required for purchases, risk-based authentication, per-account failure limits with progressive friction, device-binding/attestation for the mobile app, monitoring dashboards and alerts on failure ratios.

Rubric

Strong answers include user remediation, not just traffic blocking.

Open in the app to mark lessons complete, take notes and track your progress.