IP-based rate limiting on unauthenticated endpoints

Login, password reset, and account creation endpoints without IP-based rate limiting are open to brute-force credential stuffing and enumeration attacks. CWE-307 (Improper Restriction of Excessive Authentication Attempts) is the direct classification. OWASP API Security Top 10 2023 API4 (Unrestricted Resource Consumption) applies because password reset emails and SMS OTPs are finite, paid resources attackers can exhaust. Credential stuffing tools spray millions of username/password combinations against unthrottled login endpoints. Without rate limiting, an attacker with a breached credential list can test thousands of combinations per minute from a single IP.

Apply tight IP-based rate limits specifically on auth-critical unauthenticated endpoints. Use a shorter window and lower threshold than general API rate limits.

// src/app/api/auth/login/route.ts
import { ipRateLimit } from '@/lib/rate-limit'

export async function POST(req: Request) {
  const ip = req.headers.get('x-forwarded-for')?.split(',')[0] ?? 'unknown'
  const allowed = await ipRateLimit(ip, { max: 5, windowSeconds: 900 })  // 5 per 15 min

  if (!allowed) {
    return Response.json(
      { error: 'Too many attempts. Try again in 15 minutes.' },
      { status: 429, headers: { 'Retry-After': '900' } }
    )
  }

  // ... authentication logic
}

Apply the same limiter to /api/auth/forgot-password and /api/auth/register to prevent email/SMS bombing.