Login endpoint has rate limiting

An unprotected login endpoint allows unlimited automated password guessing. CWE-307 (Improper Restriction of Excessive Authentication Attempts) is one of the most exploited authentication failures: a botnet can attempt millions of credential combinations against any account in minutes. NIST 800-63B §5.2.2 and PCI-DSS Req-8.3.4 both mandate throttling on authentication endpoints. OWASP A07 lists brute-force susceptibility as a named failure mode. In-memory rate limiting does not survive serverless cold starts or multi-instance deployments — Redis-backed state is required for distributed environments.

Use a Redis-backed rate limiter that persists state across serverless instances. Limit by IP and by username to catch both distributed and targeted attacks:

// Using @upstash/ratelimit (serverless-safe)
import { Ratelimit } from '@upstash/ratelimit'
import { Redis } from '@upstash/redis'

const ratelimit = new Ratelimit({
  redis: Redis.fromEnv(),
  limiter: Ratelimit.slidingWindow(10, '15 m'),
  prefix: 'login'
})

export async function POST(request: Request) {
  const ip = request.headers.get('x-forwarded-for') ?? 'unknown'
  const { success } = await ratelimit.limit(ip)
  if (!success) return Response.json({ error: 'Too many attempts' }, { status: 429 })
  // login logic
}

Apply the same rate limit to password reset and OTP verification endpoints — they are equally vulnerable to abuse and are frequently overlooked.