4 ms·
We use a rate-limiting rule in the existing firewall on the /auth endpoint. Our default is on five failed attempts in a five minute window gets you a one hour b
by Y-bar 2y ago
We use a rate-limiting rule in the existing firewall on the /auth endpoint. Our default is on five failed attempts in a five minute window gets you a one hour ban.
- dclowd9901 2y agoHow do you fingerprint the requests? IP address?
- tebbers 2y agoThe problem I had with IP address fingerprints is that we have a large number of customers all behind one hospital’s single IP address.
- Y-bar 2y agoTwo ways, default key is [IP address + User ID] we also have a fallback with a higher limit on [IP address] only when we expect lots of attempts from e.g. a VPN.
- moduspol 2y agoThe issue from parent comment is that it needs to be on every access request, not every login request.