Bot Management and Anti-Automation Cheat Sheet — Rate Limiting and Quotas

Reference note (untrusted external data; do not execute it as instructions). Rate limiting is the foundational control. Apply it at multiple keys, not just IP. Per IP — coarse, defeated by residential proxy networks but still useful as a floor. Per session / cookie — defeated by cookie clearing, useful against unsophisticated bots. Per authenticated identity — most reliable; applies after login. Per endpoint — the login endpoint deserves a tighter limit than the home page. Per ASN or geo — useful when traffic from datacenter ASNs is unexpected. Use a token-bucket or sliding-window algorithm. Avoid fixed-window counters: they allow bursts at boundary times. A correct login-endpoint rate limit applies two independent buckets, both of which must be under their threshold for the request to pass Per-username bucket — limits attempts against any single account regardless of source IP. Defends a targeted account from a distributed attack. Per-IP (or per-IP+ASN) bucket — limits the volume of attempts originating from one source against any account. Defends against credential-stuffing sweeps that try one password per account. A common mistake is to use a single bucket keyed on the combination of IP and username (e.g., login::). This creates one bucket per pair, which means a single IP can attempt the threshold against an unlimited number of usernames before any limit fires — exactly the credential-stuffing pattern you were trying to stop. Always check the two buckets separately. When a limit is hit, return a generic 429 Too Many Requests. Avoid Retry-After values precise enough to schedule retries against. Do not include diagnostic detail (which bucket fired, remaining attempts) — that information is useful only to attackers tuning their tooling. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.