Controlling request volume.
WHY IT MATTERS
Without limits, anything expensive can be triggered repeatedly.
WHAT TO LIMIT
Sign-in attempts Registration Password reset requests Search API endpoints Anything sending mail or messages Anything computationally expensive
WHAT THE FRAMEWORK PROVIDES
Rate limiting middleware, configurable per route or group.
WHAT TO DEFINE
How many requests, over what period, per what identifier.
WHAT IDENTIFIER TO USE
The authenticated user, where signed in The address, otherwise
WHAT TO BE CAREFUL WITH
Address-based limits, where many users share one address.
That is common, since offices and networks share public addresses.
WHAT TO RETURN WHEN EXCEEDED
The appropriate status, with an indication of when to retry.
WHAT TO LOG
Repeated limit breaches, which may indicate an attack.
WHAT ELSE TO IMPLEMENT ON SIGN-IN
Progressive delay, and lockout after repeated failures.
WHAT TO AVOID
Limits so tight that legitimate use is blocked.
WHAT TO TEST
That the limit triggers, and that it resets.
