medium10 pts · first answer countsrate-limitingredisapi-security

Rate limiter that does not limit

The login route keeps failed attempts in an in-memory Map and blocks after 5 tries. In production the app runs on 8 instances (serverless), and brute-force attempts still succeed. Why, and what fixes it?

A.Maps are too slow; switch to a plain objectB.Each instance keeps its own count; store counters in a shared store like RedisC.Rate limits only work over HTTP/2D.The limit of 5 is too generous for production traffic; lower it to 1 attempt per account

Discussion 0

Join free to post in the discussion.

Rate limiter that does not limit

Discussion 0

Related questions