Web Security · Senior · Question 61 of 75

Which rate limiting design suits a public login API best?

1A limit in the front-end code that disables the button
2A per-server in-memory counter that resets on each deploy
✓Correct answer: Limits per account and per IP (or device), with a token bucket and growing delays, enforced at a shared layer

Explanation

Per-IP alone fails against botnets, per-account alone enables lockout attacks. A shared store like Redis keeps limits consistent across instances.

Further reading

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.