Everyone forgets to rate limit their authentication endpoints

I've been doing security reviews for a small SaaS company here in Denver for about 6 months. Every single time I check their API, they have no rate limiting on the login or password reset routes. Last week I ran a simple script from my laptop and guessed 500 passwords in under 2 minutes before they noticed. This makes brute force attacks way too easy for anyone with a basic computer. You have to cap requests to like 5 per minute on those auth endpoints. Has anyone else seen this slip through their own code reviews?

2 comments

2 Comments

rowan21mo ago

500 passwords in under 2 minutes" is wild but honestly not shocking. The bigger thing people miss is that rate limiting alone isn't enough if you're not also blocking by IP and user account separately. I've seen setups where they limit to 5 per minute per IP, but an attacker can just rotate through a list of proxies and still hit the same user account endlessly. You really need to cap both the IP and the specific endpoint per account, or you're just making them work a little harder.

vera_campbell1mo ago

Exactly. You need to layer the limits on both ends, otherwise it's just a token effort that slows them down by a few seconds. It's the combo of account-level and IP-level caps that actually forces them to change their approach.