3 ms·
Easiest way to defend against brute force attack? How does one rate limit? The only thing putting me off using HTTP auth is this. Seems like you need NGINX co
by geenat 5y ago
Easiest way to defend against brute force attack?
How does one rate limit?
The only thing putting me off using HTTP auth is this. Seems like you need NGINX configured to hold state and be the rate limiter.
- hnick 5y agoYou can use a slow validation function (bcrypt) to naturally rate limit login attempts, or log login attempts somewhere and do it based on that in the code layer. Most login schemes will have at least a basic database with a users table so it isn't much extra effort to check during validation.