Web Security and WAF · Defense in Depth: Headers, WAF, Edge and SDLC
Rate Limiting and Bot Defense
Protect logins, APIs and expensive endpoints from abuse.
Rate limiting caps request rates per client (IP, user, API key) using algorithms like token bucket or sliding window, enforced at the edge/gateway and in the application for business-aware limits. Bots require more: credential stuffing, scraping, fake signups and inventory hoarding. Combine rate limits with bot management (fingerprinting, behavioral signals, reputation), challenges (CAPTCHA/Turnstile) for suspicious traffic, and business rules (limits per account, card, address).
Layered limits for a login endpoint
- Edge: 20 req/min per IP on POST /login (burst 10) → 429 + Retry-After
- App: 5 failed attempts / 15 min per account → progressive delay + challenge
- App: global anomaly detection: failed logins > 3× baseline → enable challenge for all
- Signals: impossible travel, new device, known-breached password, ASN reputation
Common pitfalls
- IP-only limits (NAT users share IPs; attackers rotate IPs).
- Limits only in the UI path but not the API.
- Hard lockouts enabling denial of service against users.
Key points
- Limits at edge and app
- Bots need behavioral defenses
- Challenges and progressive friction
Further reading: OWASP Automated Threats
Practice questions
Why combine per-IP and per-account rate limits on login?
Answer
Per-IP stops one source hammering many accounts; per-account stops distributed attacks on one account from many IPs.
What is credential stuffing and which controls help most?
Answer
Automated login attempts with leaked username/password pairs; MFA, breached-password detection, bot detection and rate limiting are the most effective controls.
Open in the app to mark lessons complete, take notes and track your progress.