You can use a slow validation function (bcrypt) to naturally rate limit login attempts, or log login attempts somewhere and do it based on that in the code laye

You can use a slow validation function (bcrypt) to naturally rate limit login attempts, or log login attempts somewhere and do it based on that in the code layer. Most login schemes will have at least a basic database with a users table so it isn't much extra effort to check during validation.