Lesson 2.21: Credential stuffing and rate limits
Credential stuffing needs no vulnerability: attackers take usernames and passwords leaked from other sites and try them against yours, betting that people reuse passwords. A login API without limits will happily answer thousands of guesses a minute. In the lab you read the login traffic on Northwind's API: one noisy address and a quieter crowd of hundreds, the tools they use, and the accounts where the attack succeeded. Then you add an nginx rate limit to the login endpoint, test it, and see why it can only be one layer among several.
17 min
You will learn to
- Explain credential stuffing
- Find attack patterns in access logs
- Identify compromised accounts
- Configure nginx limit_req for a login endpoint
- Explain the limits of per-IP rate limiting
Key terms
- Credential stuffing
- Trying username/password pairs leaked from other sites.
- Password spraying
- Trying a few common passwords against many accounts.
- Rate limit
- A cap on requests per client and time window.
- 429 Too Many Requests
- The HTTP status for 'slow down'; may carry Retry-After.
- Residential proxies
- Networks of home connections rented to route attack traffic, so each address sends little.
- OWASP API4:2023
- Unrestricted Resource Consumption: no limits on requests, sizes or costs.
← The same-origin policy and CORS · All lessons · Service accounts and Kerberoasting →