Login Throttling

Slow Down Automated Login Attacks

A password login endpoint has to accept attempts from people who sometimes mistype their passwords. The same property also gives automated clients a place to try many guesses. If the application processes every attempt at full speed, an attacker can repeatedly test passwords against one account or spread attempts across many accounts. A correct password hash does not solve this problem. Password hashing makes each password verification deliberately costly, but the server still has to decide how many online attempts it will accept. Without another control, the application may provide an attacker with a large number of guesses over time.