Every endpoint on your app is an open invitation to send requests. Most visitors send a few. Some scripts will send as many as your server can take. Rate limiting is just the rule that says "this many, this fast, and no more." It's one of those features nobody notices when it's there and everybody notices when it isn't. Here's what it protects you from. Brute force on your login page. Without a limit, an attacker can try password after password as fast as your server answers. Even with good password hashing, you don't want to give them unlimited attempts. Abuse of expensive actions. Sending a…
Your App Needs a Speed Limit
Read post