DEV Community

loading...

Discussion on: Do password rules impact security?

Collapse
legolord208 profile image
jD91mZM2

Great, so now you can ban any user you want my spamming requests to the password endpoint so they get temporarily banned.

Collapse
antonfrattaroli profile image
Anton Frattaroli

Can rate limit by ip address as well as by user. Could also leverage machine learning to detect anomalies in auth rate.

Thread Thread
perttisoomann profile image
Pert Soomann

IP limiter is another good option too yes.

Also, you don't have to email user that their account has been suspended for 15 minutes every single time.